---
{
  "title": "Compromise Infrastructure",
  "summary": "Infrastructure compromise uses third-party resources without their owners' authorization.",
  "topic": "offensive",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    4
  ],
  "aliases": [
    "T1584"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1584: Compromise Infrastructure",
      "url": "https://attack.mitre.org/techniques/T1584"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Infrastructure compromise uses third-party resources without their owners' authorization. A legitimate host can consequently deliver or relay malicious activity.

MITRE ATT&CK catalogs this behavior as **T1584**, within resource development. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.

## An investigation example

A normally reputable website starts serving suspicious content associated with an attack against the organization.

## Evidence to examine

Review content versions, redirect behavior, delivery evidence, timing, and host relationships where available.

## A common analytical pitfall

Provider reputation does not guarantee current content integrity, and victim infrastructure is not automatically attacker-owned.

## Response considerations

Preserve delivery evidence and apply targeted protection while distinguishing a compromised relay from infrastructure controlled intentionally by the actor.

## Legitimate resources can be repurposed

A fictional small business website begins serving content used in a separate phishing operation. The domain's established history may make the traffic appear less unusual than a newly registered site. The website owner may be another victim, so association with the resource does not automatically establish participation in the campaign.

Separate the infrastructure compromise from later target activity. Evidence that a site hosted malicious content does not show that every visitor executed it or that the investigated organization was successfully compromised. Build the sequence using hosting changes, delivery evidence, connections, and endpoint effects where available.

Ownership and control can diverge. A legitimate organization may retain domain registration while an unauthorized actor controls one directory or account on the server. Describe the scope of observed control rather than labeling the entire owner malicious. This distinction also guides coordination and remediation.

## Map a compromised hosting relationship

For a paper exercise, create a fictional site owner, hosting provider, malicious upload, and recipient organization. Mark which party owns the resource, which party appears to control the uploaded content, and which facts remain unknown. Add a normal page on the same site to illustrate why broad conclusions can be misleading.

Defensive action may involve blocking the specific harmful location, preserving evidence, and contacting the appropriate owner through approved incident processes. Do not modify or investigate someone else's hosting account without authorization. A useful report states the affected resource, observed malicious use, time window, and attribution limits. This keeps the analysis focused on the compromised capability while recognizing that infrastructure owners can be victims rather than adversaries.

## Related concepts

- [[osint]]
- [[rules-of-engagement]]
- [[threat-intelligence]]
- [[obtain-capabilities]]
- [[proxy]]