Spearphishing Link
Subtechnique · ATTACK:enterprise:T1566.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1566.002",
"title": "Spearphishing Link",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1566/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--2b742742-28c3-4e1b-bab7-8350d6300fa7",
"external_id": "T1566.002",
"domain": "enterprise",
"created": "2020-03-02T19:15:44.182Z",
"modified": "2026-09-11T19:55:38.427Z",
"version": "2.8",
"aliases": [
],
"tactics": [
"initial-access"
],
"source_references": [
{
"source_name": "ACSC Email Spoofing",
"url": "https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
},
{
"source_name": "CISA IDN ST05-016",
"url": "https://us-cert.cisa.gov/ncas/tips/ST05-016"
},
{
"source_name": "Trend Micro Pawn Storm OAuth 2017",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks"
},
{
"source_name": "Netskope Device Code Phishing 2021",
"url": "https://www.netskope.com/blog/new-phishing-attacks-exploiting-oauth-authorization-flows-part-1"
},
{
"source_name": "Microsoft OAuth 2.0 Consent Phishing 2021",
"url": "https://www.microsoft.com/security/blog/2021/07/14/microsoft-delivers-comprehensive-solution-to-battle-rise-in-consent-phishing-emails/"
},
{
"source_name": "Microsoft Anti Spoofing",
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
},
{
"source_name": "Mandiant URL Obfuscation 2023",
"url": "https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse"
},
{
"source_name": "Optiv Device Code Phishing 2021",
"url": "https://www.optiv.com/insights/source-zero/blog/microsoft-365-oauth-device-code-flow-and-phishing"
},
{
"source_name": "SecureWorks Device Code Phishing 2021",
"url": "https://www.secureworks.com/blog/oauths-device-code-flow-abused-in-phishing-attacks"
}
]
}Explicit source assertions (95)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--005b46de-6241-413e-ba13-e0c2cc8efa77
ACSC Email Spoofing · Microsoft Anti SpoofingATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01455ab2-2769-4eab-9df2-e7e5f707e7c6
TrendMicro BlackTech June 2017ATTACK:enterprise:S0585 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0160acb0-db44-4076-acc6-74c872d5aa08
Amnesty Intl. Ocean Lotus February 2021ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02d478b7-c728-4b43-b599-84bd75c3546e
Anomali Static Kitten February 2021 · Proofpoint TA450 Phishing March 2024 · Trend Micro Muddy Water March 2021ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03c424ec-df52-4b08-8b32-fa8b2a738a97
Kaspersky LuminousMoth July 2021ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04b1f1a3-b46b-4af9-b21a-3e1047d2844e
Trend Micro Earth Kasha Updates APR 2025ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0930d98a-d8ae-4300-a50b-8a80b06e88e9
TrendMicro Confucius APT Aug 2021ATTACK:enterprise:G0103 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f29f072-1eb1-4711-8679-19580f16b351
FOX-IT May 2016 MofangATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f7756fb-ea96-4d3a-9a23-a0f0a326de63
EST Kimsuky April 2019 · Netscout Stolen Pencil Dec 2018 · KISA Operation MuzabiATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--118e5be5-a143-4e2f-b80f-20b580f14210
ATT Sidewinder January 2021 · Cyble Sidewinder September 2020ATTACK:enterprise:S0561 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--148f4700-9a24-4729-af76-5ff9eafb997c
Unit 42 NETWIRE April 2020ATTACK:enterprise:S1017 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d0af393-5340-4bee-bccc-b1007853276a
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e3438f9-573c-4912-81e7-650094af62ac
McAfee Night DragonATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f8132be-36d7-403e-a3e6-604db01ca3b8
MalwareBytes LazyScripter Feb 2021ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2003aaad-7b87-461d-b17f-b19100069ad9
CSM Elderwood Sept 2012 · Symantec Elderwood Sept 2012ATTACK:enterprise:S9026 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20d7fd13-f14f-49a4-81db-3c497339b6f4
Trend Micro Earth Kasha Updates APR 2025ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--239092bc-09e4-4c16-9d83-071929c9e4a4
ATTACK:enterprise:S9044 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24c2c2a0-15a5-4890-a38a-8fc8e4ccd381
Artic Wolf Labs Kali365 Device Code April 2026ATTACK:enterprise:S0528 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--272e3614-f257-4aff-9938-b03a2f16efbd
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29d8831b-42fb-4da2-aa43-7181073d5d79
Trellix Darkgate 2023ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c5ff227-9d4b-4af0-b534-83b55733f5b5
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:G0095 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dde02b3-20b9-4709-96b4-02dbb9150577
Cylance Machete Mar 2017 · ESET Machete July 2019ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30a465fc-955e-4688-9349-daf17a287c47
CISA AppleJeus Feb 2021ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34319090-f87a-431b-a6c1-38d8494495b6
BlackBerry_FIN7_April2024 · CrowdStrike Carbon Spider August 2021ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--358466fb-c847-4f14-b5cc-c368df25932b
Sophos Qilin MSP APR 2025 · SentinelOne Qilin NOV 2022ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36d41ebe-3a33-46f3-927b-42110fc2df1d
QuorumCyber_Vidar_March2023ATTACK:enterprise:T1566.002 → subtechnique-of → ATTACK:enterprise:T1566
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3819b66b-51e4-440d-93cf-12e8b6892e3e
ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--382b8780-edc3-477f-a7fa-3e6ba62397a2
Trend Micro Banking Malware Jan 2019 · Kaspersky Emotet Jan 2019 · CIS Emotet Apr 2017 · Malwarebytes Emotet Dec 2017 · Symantec Emotet Jul 2018 · US-CERT Emotet Jul 2018 · Talos Emotet Jan 2019 · Talos Emotet Jan 2019 · Picus Emotet Dec 2018ATTACK:enterprise:C0005 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--386d6f27-a0a6-44c9-bd03-8a332c5ce9e2
ESET Operation Spalax Jan 2021ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fe304c6-4f26-42a9-b1f4-22635fd01245
SocGholish-updateATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4170eaf9-9845-4f13-91b2-ff5c9931f365
US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4364b7ab-fd25-4145-84e6-e9e74ac3c0dd
Talos Oblique RAT March 2021 · Talos Transparent Tribe May 2021ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--478e4f65-d03a-4f1b-aeeb-16dddc1bfead
ESET EvilNum July 2020ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bf2c4b0-9b7c-4546-ad21-1ca6c97afd14
SCILabs Malteiro 2021ATTACK:enterprise:S0646 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50860aec-3490-4783-8ffb-ad4217cf0d58
Secureworks GOLD KINGSWOOD September 2018ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--529e6ba3-a73d-4cca-84e9-d2d047340aa0
IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · McAfee Dianxun March 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52e319bc-d6ee-4ab5-a3ae-36f0477cac67
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5758382a-2ada-4d05-ad25-8ee802a9e041
ESET OceanLotus · Cybereason Oceanlotus May 2017 · FireEye APT32 April 2020 · Volexity Ocean Lotus November 2020 · Amnesty Intl. Ocean Lotus February 2021ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5853ff4e-9982-4d66-bf98-6c22fa42f305
Malwarebytes Pony April 2016ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--598e9cc3-818c-4fc0-baf3-aba229543da5
FireEye Clandestine WolfATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bc68652-1d99-4782-80bd-086fc7f8358c
Mandiant APT1ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e28da21-d977-4488-a8dc-10bad0833374
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f90f8ec-9154-4f28-a632-fd4024e6fbce
ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61f91f23-a8a5-4b4e-b546-f0fff28851a1
Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63135ac5-fa86-41a0-9023-df4c8f830582
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--639e7b8d-57d7-4c1d-8f42-1496606ea666
FireEye APT33 Sept 2017 · Symantec Elfin Mar 2019ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--671a20b9-ad4c-468f-9871-be3545907dd2
Microsoft Targeting Elections September 2020 · Google Election Threats October 2020 · Zscaler APT31 Covid-19 October 2020ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f23e808-aa3b-4ad8-b932-e294c8921fdb
Google EXOTIC LILY March 2022ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--731a7678-8b88-47c9-88a6-7bc897bb79bb
AADInternals DocumentationATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--741c03f1-5c9c-4737-bf2d-279503a042ab
Cybereason Bumblebee August 2022 · Proofpoint Bumblebee April 2022ATTACK:enterprise:C0011 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74953cb2-4d72-487b-959b-57602ce28d07
Cisco Talos Transparent Tribe Education Campaign July 2022ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7dee0645-9c39-4e04-8012-6ae10a449ae9
Cyberreason Anchor December 2019ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fd1b042-8543-46f7-90d5-631500f17e9e
Kaspersky MoleRATs April 2019ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--808f140e-8b7b-4efa-8708-2f2308b2fc41
Certfa Charming Kitten January 2021 · ClearSky Kittens Back 3 August 2020 · Secureworks Cobalt Gypsy Feb 2017 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80c27fda-8e6c-49f4-a236-5ac424fd0849
SocGholish-updateATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8272bde7-817f-4cb4-b073-67859002d310
ClearSky OilRig Jan 2017 · Unit 42 OopsIE! Feb 2018ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88157c8d-48d7-4114-8783-d22999a8f990
SANS Windshift August 2018ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--933278a3-45a6-4d1a-93e7-76124d9938f6
Recorded Future RedDelta 2025ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95618672-6f7f-4055-9c96-29f75e276d5b
Talos Cobalt Group July 2018 · Secureworks GOLD KINGSWOOD September 2018ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95b0d9c3-e905-468c-8498-6550f2130826
Unit 42 NETWIRE April 2020ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1d7019e-ccb0-42cb-ba7c-351dd5cb152f
Mandiant No Easy Breach · MSTIC NOBELIUM May 2021 · Secureworks IRON RITUAL USAID Phish May 2021ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3a8c9e7-ed71-46c9-aa1f-c609406652b0
ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4e398b7-f518-467c-ae1b-4ea973afb11b
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7492314-41f3-4785-afee-8869f16d0204
Check Point Wirte NOV 2024ATTACK:enterprise:G0085 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8e36e77-3899-4e7c-b27e-ab6ebf049066
FireEye Hacking FIN4 Video Dec 2014 · FireEye Hacking FIN4 Dec 2014ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aafab4f1-96d9-4c9e-8f87-98a38db520fe
FireEye APT29 Nov 2018 · Microsoft Unidentified Dec 2018ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1ed7715-2145-4b26-b414-8f83a29e1f74
Telefonica Snip3 December 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5e98443-7d3a-4a0a-975d-a5c1d564bd15
Group IB Ransomware September 2020 · Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · ATT QakBot April 2021 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b711fa36-192b-4ad6-9462-790533469ce9
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--baa39a74-fd81-4e25-9e5e-a8b95147bdd5
Telefonica Snip3 December 2021 · Proofpoint TA2541 February 2022ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcf302f3-bffc-4c59-84cf-dbd0477ec207
Check Point Blind Eagle MAR 2025 · Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1b55dea-5e5d-4cff-bfac-5880507389c1
Threatpost HancitorATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c36deed2-7da5-4c41-b6f0-eebc94bb17e9
Cybereason Bazar July 2020 · Zscaler Bazar September 2020 · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cff64310-fe63-44ad-9791-d1b4b50f0229
TrendMicro EarthLusca 2022ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2187598-ade7-4ce0-8375-da55aa3369c2
group-ib_redcurl1 · group-ib_redcurl2ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2d8fc99-7aaf-41c3-98e0-0ceae6ff48ad
Microsoft Storm-1811 2024ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d42b9304-293a-4b95-a946-dcda81be5c87
ESET Turla Mosquito Jan 2018ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4f9d2ab-70d0-4aaf-9c7f-d94fc0818ecb
ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d87925c8-23ed-4913-81d6-c4d93d65c798
DHS/CISA Ransomware Targeting Healthcare October 2020 · DFIR Ryuk 2 Hour Speed Run November 2020ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9a681a0-bf13-40b2-9534-f244d48d3a92
Bleeping Computer Latrodectus April 2024 · Latrodectus APR 2024