Gather Victim Identity Information
Identity-information gathering collects details about people that can support targeting.
What it means
Identity-information gathering collects details about people that can support targeting. Public names and roles may combine with leaked or inferred information.
MITRE ATT&CK catalogs this behavior as T1589, within reconnaissance. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A targeted message accurately references an employee's role but asks for an unusual sensitive action.
Evidence to examine
Review what information was publicly available, message context, account provenance, and independent verification of the request.
A common analytical pitfall
Accurate personal details do not establish that the sender is authorized or trustworthy.
Response considerations
Reduce unnecessary public exposure where appropriate and verify sensitive requests through established trusted channels.
Identity information has context and limits
A fictional academy publishes instructor names and business email addresses. An adversary may use those details to make a message sound familiar or select an account to target. Public identity information is not equivalent to a working credential, and knowing a person's role does not establish access to their account.
Some identity evidence is more sensitive than a public contact entry. Exposed credentials or recovery details require a different response from a staff directory. Distinguish the type of information, the source's reliability, and whether current account control is affected. Do not include raw credentials in ordinary investigation notes.
Accuracy can also be misleading. A message naming the right manager and department may derive entirely from public sources. Verification should use an independent trusted channel rather than relying on how much internal-sounding detail the sender provides. Business processes must remain resistant to persuasive familiarity.
Build a minimal identity evidence record
For a learning exercise, create fictional names, roles, and addresses. Record where each detail is published and what it can reasonably support as an inference. Add an outdated employee profile and explain how the age of the source changes confidence. Avoid collecting real people's personal information for the exercise.
If a later phishing attempt uses the same details, compare wording and delivery evidence without claiming that the public directory caused the incident by itself. Review account protections and sensitive verification workflows as appropriate. The useful lesson is that identity context can support targeting, while defensible analysis keeps public facts, exposed secrets, account compromise, and attribution as separate conclusions requiring different evidence.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1589: Gather Victim Identity Information