T1496.002 - Bandwidth Hijacking

Sub-technique
Tactics:
Impact
Platforms:
Linux Windows macOS IaaS +1
Detection:
Not specified
Description:
Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking) Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise.(Citation: Unit 42 Leaked Environment Variables 2024)

In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.(Citation: Sysdig Proxyjacking)
Metadata
MITRE ID: T1496.002
STIX ID: attack-pattern--718cb208-6446-...
Platforms: Linux, Windows, macOS, IaaS, Containers
Created: 13/01/2026 17:48
Updated: 14/03/2026 04:00