Gather Victim Org Information
Organizational-information gathering learns structures and relationships useful for targeting.
What it means
Organizational-information gathering learns structures and relationships useful for targeting. Departments, suppliers, and business routines can shape credible social approaches.
MITRE ATT&CK catalogs this behavior as T1591, within reconnaissance. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A deceptive request mirrors the company's purchasing workflow and references a real supplier relationship.
Evidence to examine
Review publicly available organizational details, message provenance, requested action, and independent workflow records.
A common analytical pitfall
Knowledge of a genuine business process does not confer authority to alter it.
Response considerations
Verify sensitive business changes through existing approval channels and reduce avoidable disclosure of information that enables impersonation.
Organizational knowledge can make a request persuasive
A fictional engineering firm announces a new procurement team and a forthcoming supplier event. An adversary can use those public facts to craft a plausible request to finance staff. The information helps create context; it is not evidence that the sender belongs to the company or has entered its systems.
Organizational details include business relationships, responsibilities, locations, and operating rhythms. Their usefulness depends on the planned deception or access attempt. A public announcement may be harmless by itself but become one ingredient in a more convincing pretext. Assess the actual business process that would accept or reject the request.
Publication review should be proportionate. Organizations need to communicate with customers and partners. Instead of trying to hide every role and relationship, avoid unnecessary sensitive detail and strengthen independent approval and verification paths for consequential actions. Accurate public information should never be sufficient authority to change a payment destination.
Test a workflow against a realistic pretext
For a tabletop exercise, write a fictional message referencing the supplier event and asking for an unusual document transfer. Ask which details are publicly knowable and which trusted channel staff would use to verify the request. Do not send the simulation externally or use real confidential documents.
Record where the process depends on familiarity rather than authority. A sender using the correct department name should not bypass data-access rules. In an investigation, compare the message with available public material while keeping delivery provenance and account evidence separate. This produces a measured conclusion about possible preparation without overstating the adversary's internal knowledge or attributing the activity from corporate wording alone.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1591: Gather Victim Org Information