Skip to content

T1566 Phishing

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., Email Hiding Rules).710 Another way to accomplish this is by Email Spoofing9 the identity of the sender, which can be used to fool both the human recipient as well as automated security tools,4 or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., “thread hijacking”).2

Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,83 or install adversary-accessible remote management tools onto their computer (i.e., User Execution).5

Item Value
ID T1566
Sub-techniques T1566.001, T1566.002, T1566.003, T1566.004
Tactics TA0001
Platforms Identity Provider, Linux, Office Suite, SaaS, Windows, macOS
Version 2.7
Created 02 March 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G1049 AppleJeus AppleJeus has used spearphishing emails to distribute malicious payloads.21
G0001 Axiom Axiom has used spear phishing to initially compromise victims.2011
G0115 GOLD SOUTHFIELD GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim’s machines.22
S0009 Hikit Hikit has been spread through spear phishing.11
G1032 INC Ransom INC Ransom has used phishing to gain initial access.1812
S1139 INC Ransomware INC Ransomware campaigns have used spearphishing emails for initial access.12
G0094 Kimsuky Kimsuky has used spearphishing to gain initial access and intelligence.1716
S1073 Royal Royal has been spread through the use of phishing campaigns including “call back phishing” where victims are lured into calling a number provided through email.141513
G1041 Sea Turtle Sea Turtle used spear phishing to gain initial access to victims.19

Mitigations

ID Mitigation Description
M1049 Antivirus/Antimalware Anti-virus can automatically quarantine suspicious files.
M1047 Audit Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
M1031 Network Intrusion Prevention Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.
M1021 Restrict Web-Based Content Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.
M1054 Software Configuration Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.61
M1017 User Training Users can be trained to identify social engineering techniques and phishing emails.

References

  1. Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024. ↩

  2. Brian Krebs. (2024, March 28). Thread Hijacking: Phishes That Prey on Your Curiosity. Retrieved September 27, 2024. ↩

  3. CISA. (n.d.). Protecting Against Malicious Use of Remote Monitoring and Management Software. Retrieved February 2, 2023. ↩

  4. Itkin, Liora. (2022, September 1). Double-bounced attacks with email spoofing . Retrieved February 24, 2023. ↩

  5. Kristopher Russo. (n.d.). Luna Moth Callback Phishing Campaign. Retrieved February 2, 2023. ↩

  6. Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020. ↩

  7. Microsoft. (2023, September 22). Malicious OAuth applications abuse cloud email services to spread spam. Retrieved March 13, 2023. ↩

  8. Oren Biderman, Tomer Lahiyani, Noam Lifshitz, Ori Porag. (n.d.). LUNA MOTH: THE THREAT ACTORS BEHIND RECENT FALSE SUBSCRIPTION SCAMS. Retrieved February 2, 2023. ↩

  9. Proofpoint. (n.d.). What Is Email Spoofing?. Retrieved February 24, 2023. ↩

  10. Vicky Ray and Rob Downs. (2014, October 29). Examining a VBA-Initiated Infostealer Campaign. Retrieved March 13, 2023. ↩

  11. Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014. ↩↩

  12. SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024. ↩↩

  13. CISA. (2023, March 2). #StopRansomware: Royal Ransomware. Retrieved March 31, 2023. ↩

  14. Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023. ↩

  15. Iacono, L. and Green, S. (2023, February 13). Royal Ransomware Deep Dive. Retrieved March 30, 2023. ↩

  16. Mandiant. (n.d.). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved October 14, 2024. ↩

  17. Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024. ↩

  18. SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024. ↩

  19. Cisco Talos. (2019, April 17). Sea Turtle: DNS Hijacking Abuses Trust In Core Internet Service. Retrieved November 20, 2024. ↩

  20. Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016. ↩

  21. Michael “Barni” Barnhart, DTEX, and Anonymous SMEs. (2025, May 14). Exposing DPRK’s Cyber Syndicate and Hidden IT Workforce. Retrieved September 3, 2025. ↩

  22. Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020. ↩