Gather Victim Identity Information

Gather information about people or identities associated with a victim that can inform targeting. Relevant data can include employee names, email addresses, phone numbers, account identifiers, credentials, or MFA configuration. Information may be available in public sources or disclosed through authorized observation of authentication services; source and freshness must be recorded because public information may be incomplete or stale.