MITRE ATT&CK Technique
T1200Hardware Additions
- First Reported
- Jun 1, 2023
- Latest Reported
- Sep 14, 2026
Official Description
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.
While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.(Citation: Ossmann Star Feb 2011)(Citation: Aleks Weapons Nov 2015)(Citation: Frisk DMA August 2016)(Citation: McMillan Pwn March 2012)
While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.(Citation: Ossmann Star Feb 2011)(Citation: Aleks Weapons Nov 2015)(Citation: Frisk DMA August 2016)(Citation: McMillan Pwn March 2012)
- Tactics
- Initial Access
- Platforms
- Windows, Linux, macOS
- MITRE Version
- 1.7
- Last Modified
- Oct 24, 2025
Reported Context (2)
- The attack requires inserting a hardware interposer between the processor and a memory module to drop memory writes. DDRop Hardware Attack Exploits Stale Memory Writes in Intel and AMD Confidential Computing
- BouldSpy's intrusion vector reportedly appears to involve physical access to devices. May Threat Intelligence Roundup Covers Skimmers, Malware and Cyber Espionage
Malware (6)
Threat Actors (4)
MITRE ATT&CK (8)
Vendors (7)
Products (11)
Industries (2)
Countries (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.