Activity timeline
T1589.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 4 reports, and 12 of the 12 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1589.003 Employee Names is catalogued by MITRE ATT&CK under the Reconnaissance tactic in the Enterprise matrix, as a sub-technique of T1589 Gather Victim Identity Information. Threadlinqs maps 12 of 2623 tracked threats (0.5%) to it; by severity that is 3 critical, 9 high.
Threats that use T1589.003 most often also use T1657 Financial Theft (9 threats), T1071.001 Web Protocols (6 threats), T1078.004 Cloud Accounts (6 threats), T1036.005 Match Legitimate Resource Name or Location (5 threats), T1005 Data from Local System (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
12 tracked threat actors appear in the threats that use T1589.003; the most frequent are ALPHV (1), APT38 (1), Andariel (1), BlackCat (1), Contagious Interview (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1589.003.
Threat actors using it
Tracked threats
12 tracked threats use T1589.003.
- OAuth Client ID Spoofing Enables Stealthy Enumeration of Microsoft Entra ID Accounts (UNK_pyreq2323 /…high
- "Phantom Deal": Fake M&A Business Email/WhatsApp Compromise Scam Targets Large Enterprises with Forged NDAshigh
- Password spraying attacks surge 155x as hackers exploit MFA gaps via Azure CLI / ROPC flowhigh
- Ransomware Gangs Shift Targeting from Executives to Mid-Level IT/Finance Managers (Zscaler ThreatLabz…high
- BlackCat/ALPHV Ransomware Abuses Azure Storage Account Keys via Sphynx Encryptor to Mass-Encrypt Cloud Storagehigh
- EtherHiding on macOS: Blockchain-Resolved C2 via Polygon Smart Contracthigh
- Contagious Interview (DPRK) Uses SVG Steganography to Deliver OTTERCOOKIE/BEAVERTAIL Malware (REF9403)high
- ShinyHunters (UNC6040/UNC6395) OAuth Consent Abuse Against Salesforce and Connected SaaS Integrationshigh
- Kali365/Octopi365 Device Code Phishing-as-a-Service Campaigncritical
- Silent Ransom Group (Luna Moth / Chatty Spider / UNC3753) — IT Support Impersonation Campaign Targeting US…high
- Storm-2949 Cloud-Wide Breach — SSPR Abuse & Azure RBAC Lateral Movement to Mass Data Exfiltrationcritical
- KelpDAO LayerZero Bridge Exploit — $292M rsETH Minted Against Non-Existent Burn (Lazarus Group, April 2026)critical
Detection coverage
Threadlinqs maintains 10 detection rules mapped to T1589.003 (SPL 2, KQL 4, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1589 Gather Victim Identity Information — 228 tracked threats at the technique level.