MITRE ATT&CKtechnique

T0882 Theft of Operational Information

Published 2020-05-21 Modified 2026-05-12 Official page ↗
Domain
ics
Tactics
Impact
Platforms
None
Version
1.0
Created
2020-05-21

Description

Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations. This information may include design documents, schedules, rotational data, or similar artifacts that provide insight on operations. In the Bowman Dam incident, adversaries probed systems for operational data.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M0803 Data Loss Prevention mitigation
  • M0941 Encrypt Sensitive Information mitigation
  • M0809 Operational Information Confidentiality mitigation
  • M0922 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (5)

  • C0063 2025 Poland Wiper Attacks campaign
  • S0496 REvil software (malware)
  • S0038 Duqu software (malware)
  • S0143 Flame software (malware)
  • S1000 ACAD/Medre.A software (malware)

References