Home
ATT&CK Techniques
T1496 Resource Hijacking

T1496 Resource Hijacking

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Resource hijacking may take a number of different forms. For example, adversaries may:

Leverage compute resources in order to mine cryptocurrency
Sell network bandwidth to proxy networks
Generate SMS traffic for profit
Abuse cloud-based messaging services to send large quantities of spam messages

In some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023)

View in MITRE ATT&CK®

VERIS Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name
action.hacking.variety.Hijack	To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)	related-to	T1496	Resource Hijacking
action.malware.variety.Click fraud	Click fraud, whether or not cryptocurrency mining. Also mark 'Click fraud or cryptocurrency mining'. Child of 'Click fraud and cryptocurrency mining'.	related-to	T1496	Resource Hijacking
action.malware.variety.Click fraud and cryptocurrency mining	Click fraud or cryptocurrency mining. Parent of 'Click fraud' and 'Cryptocurrency mining'.	related-to	T1496	Resource Hijacking
action.malware.variety.Cryptocurrency mining	Cryptocurrency mining, whether or not click fraud. Child of 'Click fraud and cryptocurrency mining'.	related-to	T1496	Resource Hijacking
attribute.availability.variety.Degradation	Performance degradation	related-to	T1496	Resource Hijacking

ATT&CK Subtechniques

Technique ID	Technique Name	Number of Mappings
T1496.003	SMS Pumping	2
T1496.002	Bandwidth Hijacking	1
T1496.004	Cloud Service Hijacking	1
T1496.001	Compute Hijacking	4