MITRE ATLAS / Resource Development
The adversary builds, buys, or steals the resources needed to support an attack, using techniques such as Acquire Public AI Artifacts, Develop Capabilities, and Publish Poisoned Datasets.
Attackers set up their toolkit: grabbing public models and datasets, writing malware, renting servers and accounts, or seeding tampered data for later use.