Email Accounts
Subtechnique · ATTACK:enterprise:T1586.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1586.002",
"title": "Email Accounts",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1586/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--3dc8c101-d4db-4f4d-8150-1b5a76ca5f1b",
"external_id": "T1586.002",
"domain": "enterprise",
"created": "2020-10-01T01:20:53.104Z",
"modified": "2026-05-12T15:12:00.628Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "AnonHBGary",
"url": "https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/"
},
{
"source_name": "Microsoft DEV-0537",
"url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b44ae9f-29b7-45e0-9396-a84899e73a3b
Google TAG Ukraine Threat Landscape March 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32126e79-18ce-4393-a555-50aa34760da9
IBM ITG18 2020ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42641f16-2ef3-4b8e-b4c6-0205a5cb9f1e
2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ea45077-b2a0-48ce-9ae7-30ad56d0b4a6
ClearSky OilRig Jan 2017ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6eca6ae2-3f86-4b45-86c4-0ac01dfd13dd
SecureWorks August 2019ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--771bb993-77b0-4019-906e-b59011943740
ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78073196-9fea-4d84-a457-6b51afb71ed1
VirusBulletin Kimsuky October 2019 · Malwarebytes Kimsuky June 2021ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78a09e58-91be-4a93-ad9c-644f04982fdf
Check Point Wirte NOV 2024ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3db41d0-a023-479f-b8eb-9065063ad7dc
Recorded Future TAG-144 AUG 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:T1586.002 → subtechnique-of → ATTACK:enterprise:T1586
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7f99597-3cbb-4cc4-a0d5-1d2abd84dbea
ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8fe7b85-3b63-4881-9d26-9874eb2d7bdd
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd3b70d0-9cd4-48e1-afd3-3457d7b5f8df
Google Salesforce JUN 2025ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--beaf6c2d-e416-4edc-8091-414eee53f604
NCC Group LAPSUS Apr 2022 · MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G0136 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c291a0b4-31b5-4075-9672-b10b0e7bd4cc
Checkpoint IndigoZebra July 2021ATTACK:enterprise:G1037 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8eae2c0-acc2-4bc5-9eb2-ea7550ff6989
Latrodectus APR 2024ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e794539e-3c07-4954-ba3c-f6c8ea6432e0
ANSSI Nobelium Phishing December 2021 · Mandiant APT29 Microsoft 365 2022ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2089e12-e97c-4b78-92fc-c5476faa43a9
CISA Star Blizzard Advisory December 2023ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe4a20ca-7a57-44b7-bcf3-0f51fe9abffa
CISA AA21-200A APT40 July 2021