Resource Hijacking: Bandwidth Hijacking
- ID
- T1496.002
- Tactics
- TA0040 Impact
- Sub-technique of
- T1496 Resource Hijacking
- Platforms
- Linux, Windows, macOS, IaaS, Containers
- Data sources
- Network Connection Creation, Process Creation, Network Traffic Flow, Network Traffic Content, Instance Start
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate Network Denial of Service campaigns and/or to seed malicious torrents.[1] Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.[2] Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise.[3]
In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.[2]
Detection
- DET0028 Detect Excessive or Unauthorized Bandwidth Usage for Botnet, Proxyjacking, or Scanning Purposes
Data components: Network Connection Creation, Process Creation, Network Traffic Flow, Network Traffic Content, Instance Start