伪装是攻击者通过伪造身份或权限，冒充可信实体以实施欺骗行为的战术手段。其核心目标是通过构建虚假信任关系，诱导受害者执行敏感操作（如转账、凭证提供或权限授予）。传统防御手段主要依赖邮件安全协议（SPF/DKIM/DMARC）验证、域名相似度分析、社交平台身份认证机制等，通过技术验证与人工审核相结合的方式识别异常身份特征。
当前伪装匿迹技术的演进呈现身份伪造立体化与行为模拟智能化的双重特征。攻击者突破传统单维度身份模仿，构建覆盖数字证书、通信协议、交互内容的全链路可信证据链：可信域名仿冒通过国际化域名注册与邮件验证记录伪造，实现技术层面的"合法身份"构建；邮件头注入攻击利用协议规范漏洞绕过传统邮件安全网关，在保持SPF校验通过的前提下实施发件人伪装；社交媒体克隆则结合AI生成技术与社交图谱分析，实现动态行为特征的精准模仿。三类技术的共性在于将身份伪造从静态资料复制升级为动态信任关系构建，通过技术手段与心理操纵相结合，使得伪装行为既满足技术验证要求，又符合目标对象的认知习惯，形成难以通过自动化系统或人工审查识别的深度欺骗。
伪装匿迹技术的升级导致传统基于规则匹配的身份验证体系防护效能显著下降。防御方需构建多模态身份认证机制，融合行为生物特征分析、跨平台身份关联验证等技术，同时结合AI驱动的异常交互模式检测，实现对动态伪装攻击的实时识别与阻断。
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ✅ |
| 行为透明 | ✅ |
| 数据遮蔽 | ✅ |
| 时空释痕 | ❌ |
攻击者通过精准模仿合法实体的数字身份特征实现深度伪装。包括使用视觉不可区分的仿冒域名、伪造邮件安全协议记录、克隆社交媒体资料等手法，使得恶意账户在技术验证和人工审查层面均呈现合法特征。该效应使得防御方难以通过表面特征识别伪装行为。
通过AI驱动的行为模式学习和动态内容生成，攻击者能够精确复制目标对象的交互特征（如邮件用语习惯、社交互动节奏）。这种基于机器学习的模仿使得伪装行为与正常业务操作在时序特征和语义逻辑上高度吻合，传统基于行为异常检测的防御机制难以发现。
在通信过程中使用端到端加密（如PGP邮件加密）或HTTPS协议传输欺骗内容，隐藏恶意负载和交互细节。同时利用社交媒体平台的私有API接口进行隐蔽通信，使得网络层检测设备无法解析实际传输的诱导信息，实现攻击意图的深度隐藏。
| ID | Name | Description |
|---|---|---|
| G0096 | APT41 |
APT41 impersonated an employee at a video game developer company to send phishing emails.[1] |
| C0027 | C0027 |
During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools.[2] |
| G1004 | LAPSUS$ |
LAPSUS$ has called victims' help desk and impersonated legitimate users with previously gathered information in order to gain access to privileged accounts.[3] |
| S1131 | NPPSPY |
NPPSPY creates a network listener using the misspelled label |
| C0022 | Operation Dream Job |
During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.[5][6][7] |
| G1031 | Saint Bear |
Saint Bear has impersonated government and related entities in both phishing activity and developing web sites with malicious links that mimic legitimate resources.[8] |
| G1015 | Scattered Spider |
During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools.[2] Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens.[9][10] |
| ID | Mitigation | Description |
|---|---|---|
| M1019 | Threat Intelligence Program |
Threat intelligence helps defenders and users be aware of and defend against common lures and active campaigns that have been used for impersonation. |
| M1017 | User Training |
Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in-person, to reduce risk. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0015 | Application Log | Application Log Content |
Review and monitor email and other user communication logs for signs of impersonation, such as suspicious emails (e.g., from known malicious or compromised accounts) or content associated with an adversary's actions on objective (e.g., abnormal monetary transactions). |