Description
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution.(Citation: Unit 42 DarkHydrus July 2018) Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.
Platforms
Mitigations (7)
Network Intrusion PreventionM1031
Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.
Restrict Web-Based ContentM1021
Block unknown or unused attachments by default that should not be transmitted over email as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some email scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious attachments.
User TrainingM1017
Users can be trained to identify social engineering techniques and spearphishing emails.
User Account ManagementM1018
Apply user account management principles to limit permissions for accounts interacting with email attachments, ensuring that only necessary accounts have the ability to open or execute files. Restricting account privileges reduces the potential impact of malicious attachments by preventing unauthorized execution or spread of malware within the environment.
Antivirus/AntimalwareM1049
Anti-virus can also automatically quarantine suspicious files.
Software ConfigurationM1054
Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.(Citation: Microsoft Anti Spoofing)(Citation
AuditM1047
Enable auditing and monitoring for email attachments and file transfers to detect and investigate suspicious activity. Regularly review logs for anomalies related to attachments containing potentially malicious content, as well as any attempts to execute or interact with these files. This practice helps identify spearphishing attempts before they can lead to further compromise.
Threat Groups (78)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has conducted spearphishing campaigns using malicious email attachments.(Citation: CISA AA20-239A Beagl... |
| G0066 | Elderwood | [Elderwood](https://attack.mitre.org/groups/G0066) has delivered zero-day exploits and malware to victims via targeted emails containing malicious att... |
| G1008 | SideCopy | [SideCopy](https://attack.mitre.org/groups/G1008) has sent spearphishing emails with malicious hta file attachments.(Citation: MalwareBytes SideCopy D... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphi... |
| G1011 | EXOTIC LILY | [EXOTIC LILY](https://attack.mitre.org/groups/G1011) conducted an e-mail thread-hijacking campaign with malicious ISO attachments.(Citation: Google EX... |
| G0018 | admin@338 | [admin@338](https://attack.mitre.org/groups/G0018) has sent emails with malicious Microsoft Office documents attached.(Citation: FireEye admin@338) |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) has used spearphishing with an attachment to deliver files with exploits to initial victims.(Citati... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise t... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has sent emails with malicious attachments to gain initial access.(Citation: Gigamon Berserk Bear O... |
| G0078 | Gorgon Group | [Gorgon Group](https://attack.mitre.org/groups/G0078) sent emails to victims with malicious Microsoft Office documents attached.(Citation: Unit 42 Gor... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has sent malicious Office documents via email as part of spearphishing campaigns as well as executab... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.(Citat... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has compromised third parties and used compromised accounts to send spearphishing emails with targ... |
| G0019 | Naikon | [Naikon](https://attack.mitre.org/groups/G0019) has used malicious e-mail attachments to deliver malware.(Citation: CheckPoint Naikon May 2020) |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) has targeted victims with e-mails containing malicious attachments.(Citation: Visa FIN6 Feb 2019) |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has delivered spearphishing emails with malicious attachments to targets.(Citation: TrendMicr... |
| G0084 | Gallmaker | [Gallmaker](https://attack.mitre.org/groups/G0084) sent emails with malicious Microsoft Office documents attached.(Citation: Symantec Gallmaker Oct 20... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.(Citation: Fir... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.(Cit... |
| G0095 | Machete | [Machete](https://attack.mitre.org/groups/G0095) has delivered spearphishing emails that contain a zipped file with malicious contents.(Citation: Sec... |
Associated Software (61)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) has used an email with an Excel sheet containing a malicious macro to deploy the malware(Citation:... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has been delivered by phishing emails containing malicious Microsoft Office documents.(Citation... |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) has gained execution through luring users into opening malicious attachments.(Citation: Proofpoin... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) has been delivered to victims as a malicious email attachment.(Citation: Mandiant Suspected Turla... |
| S0665 | ThreatNeedle | Malware | [ThreatNeedle](https://attack.mitre.org/software/S0665) has been distributed via a malicious Word document within a spearphishing email.(Citation: Kas... |
| S0453 | Pony | Malware | [Pony](https://attack.mitre.org/software/S0453) has been delivered via spearphishing attachments.(Citation: Malwarebytes Pony April 2016) |
| S0346 | OceanSalt | Malware | [OceanSalt](https://attack.mitre.org/software/S0346) has been delivered via spearphishing emails with Microsoft Office attachments.(Citation: McAfee O... |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) has been distributed to victims through malicious e-mail attachments.(Citation: Malwarebytes Kims... |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) has been spread via e-mail campaigns utilizing malicious attachments.(Citation: Unit 42 NETWIRE Apr... |
| S0634 | EnvyScout | Malware | [EnvyScout](https://attack.mitre.org/software/S0634) has been distributed via spearphishing as an email attachment.(Citation: MSTIC Nobelium Toolset M... |
| S0367 | Emotet | Malware | [Emotet](https://attack.mitre.org/software/S0367) has been delivered by phishing emails containing attachments. (Citation: CIS Emotet Apr 2017)(Citati... |
| S1065 | Woody RAT | Malware | [Woody RAT](https://attack.mitre.org/software/S1065) has been delivered via malicious Word documents and archive files.(Citation: MalwareBytes WoodyRA... |
| S1030 | Squirrelwaffle | Malware | [Squirrelwaffle](https://attack.mitre.org/software/S1030) has been distributed via malicious Microsoft Office documents within spam emails.(Citation: ... |
| S1086 | Snip3 | Malware | [Snip3](https://attack.mitre.org/software/S1086) has been delivered to victims through malicious e-mail attachments.(Citation: Telefonica Snip3 Decemb... |
| S0433 | Rifdoor | Malware | [Rifdoor](https://attack.mitre.org/software/S0433) has been distributed in e-mails with malicious Excel or Word documents.(Citation: Carbon Black HotC... |
| S9037 | RustyWater | Malware | [RustyWater](https://attack.mitre.org/software/S9037) has sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primary... |
| S0483 | IcedID | Malware | [IcedID](https://attack.mitre.org/software/S0483) has been delivered via phishing e-mails with malicious attachments.(Citation: Juniper IcedID June 20... |
| S0696 | Flagpro | Malware | [Flagpro](https://attack.mitre.org/software/S0696) has been distributed via spearphishing as an email attachment.(Citation: NTT Security Flagpro new D... |
| S1066 | DarkTortilla | Malware | [DarkTortilla](https://attack.mitre.org/software/S1066) has been distributed via spearphishing emails containing archive attachments, with file types ... |
| S0240 | ROKRAT | Malware | [ROKRAT](https://attack.mitre.org/software/S0240) has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word... |
References
- Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.
- Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
- Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.
- Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 17, 2024.
Frequently Asked Questions
What is T1566.001 (Spearphishing Attachment)?
T1566.001 is a MITRE ATT&CK technique named 'Spearphishing Attachment'. It belongs to the Initial Access tactic(s). Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing att...
How can T1566.001 be detected?
Detection of T1566.001 (Spearphishing Attachment) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1566.001?
There are 7 documented mitigations for T1566.001. Key mitigations include: Network Intrusion Prevention, Restrict Web-Based Content, User Training, User Account Management, Antivirus/Antimalware.
Which threat groups use T1566.001?
Known threat groups using T1566.001 include: APT38, Elderwood, SideCopy, Kimsuky, EXOTIC LILY, admin@338, Patchwork, APT41.