# T1590 Gather Victim Network Information

> As of 2026-10-05, T1590 (Gather Victim Network Information) appears in 99 tracked threats, first reported 2026-01-25 and most recently 2026-08-29, with linked actors including Static Tundra, FSB Center 16, MuddyWater; it most often appears alongside T1190 (Exploit Public-Facing Application).

- **Tracked threats:** 99 (43 critical, 46 high, 8 medium)
- **First seen:** 2026-01-25
- **Last seen:** 2026-08-29
- **Threat actors:** 27
- **Detection rules:** 49 (counts only; Blue tier and above)

## Key facts

- **ID:** T1590
- **Framework:** MITRE ATT&CK
- **Tactics:** Reconnaissance
- **Matrix:** Enterprise
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1590/

## Activity timeline

T1590 first appeared in tracked threats on 2026-01-25 and was most recently reported on 2026-08-29. The busiest month was 2026-07 with 38 reports, and 99 of the 99 threats were reported in the twelve months to 2026-08.

## How adversaries use it

T1590 Gather Victim Network Information is catalogued by MITRE ATT&CK under the Reconnaissance tactic in the Enterprise matrix. Threadlinqs maps 99 of 2623 tracked threats (3.8%) to it; by severity that is 43 critical, 46 high, 8 medium.

Threats that use T1590 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (79 threats), [T1595 Active Scanning](https://intel.threadlinqs.com/technique/T1595) (61 threats), [T1046 Network Service Discovery](https://intel.threadlinqs.com/technique/T1046) (55 threats), [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) (51 threats), [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) (50 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

27 tracked threat actors appear in the threats that use T1590; the most frequent are [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) (5), [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) (3), [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) (3), [APT28](https://intel.threadlinqs.com/actor/APT28) (1), [APT35](https://intel.threadlinqs.com/actor/APT35) (1).

## Mitigations

MITRE ATT&CK lists 1 mitigation for T1590.

- [M1056 Pre-compromise](https://attack.mitre.org/mitigations/M1056/)

## Threat actors using it

- [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) — 5
- [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) — 3
- [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 3
- [APT28](https://intel.threadlinqs.com/actor/APT28) — 1
- [APT35](https://intel.threadlinqs.com/actor/APT35) — 1
- [APT42](https://intel.threadlinqs.com/actor/APT42) — 1
- [Akira](https://intel.threadlinqs.com/actor/Akira) — 1
- [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1
- [Earth Lusca](https://intel.threadlinqs.com/actor/Earth%20Lusca) — 1
- [FortiBleed operator](https://intel.threadlinqs.com/actor/FortiBleed%20operator) — 1
- [Handala](https://intel.threadlinqs.com/actor/Handala) — 1
- [Handala Hack](https://intel.threadlinqs.com/actor/Handala%20Hack) — 1

## Tracked threats

The 30 most recent of 99 tracked threats that use T1590.

- [Pre-Authentication Remote Code Execution in SPIP CMS (CVE-2026-77806) — Actively Exploited](https://intel.threadlinqs.com/threat/TL-2026-2221) — critical — 2026-08-29
- [NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows Unauthenticated Spacecraft Command Injection…](https://intel.threadlinqs.com/threat/TL-2026-2081) — critical — 2026-08-20
- [CVE-2026-19490 — Critical Authentication Bypass in Citrix NetScaler ADC and Gateway (CVSS 9.3) with…](https://intel.threadlinqs.com/threat/TL-2026-2080) — critical — 2026-08-20
- [Suspected China-Linked Actor Runs Near-Autonomous Multi-Agent AI Attack on Taiwan Government, Nuclear Safety…](https://intel.threadlinqs.com/threat/TL-2026-2063) — critical — 2026-08-18
- [White House Authorizes Private US Companies to Conduct Offensive Cyber Operations Against Foreign Criminal…](https://intel.threadlinqs.com/threat/TL-2026-2012) — 2026-08-13
- [Cisco Secure Firewall ASA/FTD Zero-Day (CVE-2026-20349) Exploited for DoS via Crafted HTTP Requests to…](https://intel.threadlinqs.com/threat/TL-2026-1993) — high — 2026-08-12
- [CVE-2025-55241: Microsoft Entra ID Actor Token Flaw Allowed Cross-Tenant Global Admin Impersonation](https://intel.threadlinqs.com/threat/TL-2026-1986) — critical — 2026-08-11
- [CI Fortify: CISA/ASD/NCSC-UK/CCCS Joint OT Isolation Guidance Exposes Communications-Continuity Gap for…](https://intel.threadlinqs.com/threat/TL-2026-1932) — 2026-08-07
- [NatJack: NAT Connection-Tracking Manipulation Attacks Hijack TCP Sessions Across Windows, Linux, and macOS…](https://intel.threadlinqs.com/threat/TL-2026-1927) — high — 2026-08-07
- [CVE-2026-16812 — Critical Unauthenticated OS Command Injection in Arista VeloCloud Orchestrator Actively…](https://intel.threadlinqs.com/threat/TL-2026-1851) — critical — 2026-08-03
- [SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58 Million Connection Logs, 23.4M User Records](https://intel.threadlinqs.com/threat/TL-2026-1823) — high — 2026-08-02
- [CaptiveCrunch: Storm-2945 (Midnight Blizzard sub-cluster) Hijacks Hotel Wi-Fi Captive Portals to Deliver…](https://intel.threadlinqs.com/threat/TL-2026-1808) — high — 2026-07-31
- [SplitVPN (formerly NotVPN) Breach Exposes 58M Connection Logs, 23.4M User Records Despite 'No Logs' Claims](https://intel.threadlinqs.com/threat/TL-2026-1815) — high — 2026-07-29
- [CubePilot Drone Autopilot Vendor Hit by DNS Hijacking, Enabling Traffic Interception and Fraudulent TLS…](https://intel.threadlinqs.com/threat/TL-2026-1749) — high — 2026-07-28
- [CVE-2026-54121 ("Certighost"): Low-Privileged AD CS Enrollment Flaw Enables Domain Controller Impersonation](https://intel.threadlinqs.com/threat/TL-2026-1675) — critical — 2026-07-24
- [CVE-2026-16232: Check Point SmartConsole Authentication Bypass Actively Exploited, Added to CISA KEV](https://intel.threadlinqs.com/threat/TL-2026-1650) — critical — 2026-07-23
- [Russian Intelligence Services Hijack Unsecured IP Cameras Across NATO, EU and Ukraine to Surveil Weapons…](https://intel.threadlinqs.com/threat/TL-2026-1624) — high — 2026-07-22
- [Oracle Supply Chain: Multiple Vulnerabilities (CERT-Bund WID-SEC-2026-2450, Oracle CPU July 2026)](https://intel.threadlinqs.com/threat/TL-2026-1616) — high — 2026-07-22
- [NULLZEREPTOOL: Telegram-Controlled Python DDoS and Multi-Function Attack Framework](https://intel.threadlinqs.com/threat/TL-2026-1592) — medium — 2026-07-21
- [Patriot Bait Actor "bandcampro" Abuses Jailbroken Google Gemini CLI to Build and Operate a Dental Clinic…](https://intel.threadlinqs.com/threat/TL-2026-1574) — medium — 2026-07-20
- [MuddyWater APT (Iran MOIS-linked, G0069) abuses legitimate RMM tools, VBA macro loaders, and Rust-compiled…](https://intel.threadlinqs.com/threat/TL-2026-1530) — high — 2026-07-19
- [CVE-2026-32746: Pre-Auth BSS Buffer Overflow in GNU inetutils telnetd LINEMODE SLC Handling](https://intel.threadlinqs.com/threat/TL-2026-1515) — high — 2026-07-19
- [Forest Blizzard (Russian GRU Unit 26165) SOHO Router DNS-Hijacking Campaign Enables AitM Credential Theft…](https://intel.threadlinqs.com/threat/TL-2026-1497) — high — 2026-07-18
- [Iran-Linked Actors Track US Military Personnel via SS7 Roaming Abuse and Ad-Tech Location Data](https://intel.threadlinqs.com/threat/TL-2026-1458) — high — 2026-07-17
- [HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats Server Memory With 11-Byte Payload](https://intel.threadlinqs.com/threat/TL-2026-1457) — medium — 2026-07-17
- [NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) for…](https://intel.threadlinqs.com/threat/TL-2026-1455) — high — 2026-07-17
- [CVE-2026-59208: Cross-Issuer Impersonation in n8n Enterprise Token Exchange](https://intel.threadlinqs.com/threat/TL-2026-1436) — high — 2026-07-17
- [Ransomware Attack on Coca-Cola's Fairlife Dairy Subsidiary Halts US Production](https://intel.threadlinqs.com/threat/TL-2026-1427) — high — 2026-07-16
- [Zoom Patches Critical Windows Client Flaw (CVE-2026-53412, CVSS 9.8) Enabling Unauthenticated Account Takeover](https://intel.threadlinqs.com/threat/TL-2026-1405) — critical — 2026-07-16
- [Operation Fake KickOff: Recruiter-Impersonation AitM/BitB Toolkit Abuses Salesforce, SendGrid, Zoho and…](https://intel.threadlinqs.com/threat/TL-2026-1388) — high — 2026-07-15

## Related CVEs

CVEs referenced by the tracked threats that use T1590, most frequent first.

- [CVE-2018-0171](https://intel.threadlinqs.com/cve/CVE-2018-0171)
- [CVE-2026-3055](https://intel.threadlinqs.com/cve/CVE-2026-3055)
- [CVE-2026-4368](https://intel.threadlinqs.com/cve/CVE-2026-4368)
- [CVE-2026-46817](https://intel.threadlinqs.com/cve/CVE-2026-46817)
- [CVE-2008-4128](https://intel.threadlinqs.com/cve/CVE-2008-4128)
- [CVE-2024-37085](https://intel.threadlinqs.com/cve/CVE-2024-37085)
- [CVE-2025-33073](https://intel.threadlinqs.com/cve/CVE-2025-33073)
- [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182)
- [CVE-2026-41089](https://intel.threadlinqs.com/cve/CVE-2026-41089)
- [CVE-2012-1823](https://intel.threadlinqs.com/cve/CVE-2012-1823)
- [CVE-2013-3307](https://intel.threadlinqs.com/cve/CVE-2013-3307)
- [CVE-2016-4437](https://intel.threadlinqs.com/cve/CVE-2016-4437)
- [CVE-2016-5195](https://intel.threadlinqs.com/cve/CVE-2016-5195)
- [CVE-2016-5681](https://intel.threadlinqs.com/cve/CVE-2016-5681)
- [CVE-2016-7407](https://intel.threadlinqs.com/cve/CVE-2016-7407)
- [CVE-2017-11317](https://intel.threadlinqs.com/cve/CVE-2017-11317)
- [CVE-2017-3506](https://intel.threadlinqs.com/cve/CVE-2017-3506)
- [CVE-2019-18935](https://intel.threadlinqs.com/cve/CVE-2019-18935)
- [CVE-2021-22054](https://intel.threadlinqs.com/cve/CVE-2021-22054)
- [CVE-2021-22205](https://intel.threadlinqs.com/cve/CVE-2021-22205)
- [CVE-2021-26855](https://intel.threadlinqs.com/cve/CVE-2021-26855)
- [CVE-2021-27076](https://intel.threadlinqs.com/cve/CVE-2021-27076)
- [CVE-2021-36260](https://intel.threadlinqs.com/cve/CVE-2021-36260)
- [CVE-2021-39275](https://intel.threadlinqs.com/cve/CVE-2021-39275)
- [CVE-2021-4034](https://intel.threadlinqs.com/cve/CVE-2021-4034)
- [CVE-2022-0543](https://intel.threadlinqs.com/cve/CVE-2022-0543)
- [CVE-2022-27925](https://intel.threadlinqs.com/cve/CVE-2022-27925)
- [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684)
- [CVE-2022-41082](https://intel.threadlinqs.com/cve/CVE-2022-41082)
- [CVE-2023-20198](https://intel.threadlinqs.com/cve/CVE-2023-20198)

## Detection coverage

Threadlinqs maintains 49 detection rules mapped to T1590 (SPL 16, KQL 15, Sigma 18). Rule content is available to Blue tier accounts and above; this page shows counts only.

49 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Sub-techniques

- T1590.001 Domain Properties — 3 tracked threats
- T1590.002 DNS — 4 tracked threats
- T1590.003 Network Trust Dependencies — 0 tracked threats
- T1590.004 Network Topology — 1 tracked threat
- T1590.005 IP Addresses — 8 tracked threats
- T1590.006 Network Security Appliances — 3 tracked threats

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1590
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)