Compromise Infrastructure (T1584): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1584.
- Tactical Phase: Resource Development.
- Substantiated in 3 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (3)
Volt Typhoon Critical Infrastructure Pre-Positioning
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
"Adversaries routed traffic through the KV-botnet of infected small office and home office (SOHO) Cisco and Netgear routers across the United States."
U.S. v. Peter Levashov (Kelihos Botnet)
Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.
"Levashov leased out compromised zombie computers as an automated bulletproof proxy network to shield criminal infrastructure."
U.S. v. Elena Alekseevna Khusyaynova (Project Lakhta)
Russian chief accountant charged with managing the financial administration of Project Lakhta, a massive state-funded covert influence and cyber operation designed to sow political discord in U.S. elections.
"Operatives purchased thousands of virtual private servers and compromised proxy networks in the United States to disguise Russian origins."
Commonly Charged Criminal Statutes
Conspiracy to Commit Computer Fraud
Punishes any person who conspires to commit or attempts to commit any computer fraud offense under section 1030.
Wire Fraud
Prohibits devising a scheme or artifice to defraud or obtain money or property by means of false or fraudulent pretenses, representations, or promises via wire communications.
Conspiracy to Commit Wire Fraud
Applies the same penalties as the underlying substantive wire fraud offense to any person who attempts or conspires to commit wire fraud.
Fraud and Related Activity in Connection with Access Devices
Prohibits knowingly producing, using, or trafficking in counterfeit access devices or unauthorized access devices including stolen credit card numbers.