File and Directory Discovery (T1083): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1083.
- Tactical Phase: Discovery.
- Substantiated in 3 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (3)
ALPHV / BlackCat Ransomware Attack on Change Healthcare
Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.
Affiliates spent nine days surveying network shares and cloud environments, targeting database servers storing patient records, Medicare claims, and billing logs.
U.S. v. Paige Thompson (Capital One Cloud Breach)
Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.
"Thompson ran automated aws-s3 listing commands to enumerate bucket contents across victim customer directories."
U.S. v. Wu et al. (Equifax PLA Unit 54th Research Institute)
Four military officers with the Chinese People's Liberation Army (PLA) 54th Research Institute charged with hacking into Equifax networks, stealing trade secrets, and exfiltrating personally identifiable information (PII) of roughly 147 million American citizens.
Operatives ran approximately 9,000 internal database queries to locate consumer credit data, extracting unencrypted credentials stored in plaintext configuration files.
Commonly Charged Criminal Statutes
Unauthorized Access to Obtain Protected Information
Prohibits intentionally accessing a computer without authorization or exceeding authorized access to obtain financial, government, or protected computer records.
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
Wire Fraud
Prohibits devising a scheme or artifice to defraud or obtain money or property by means of false or fraudulent pretenses, representations, or promises via wire communications.