Procedure examples

During Operation Dream Job, Lazarus Group created fake email accounts to correspond with fake LinkedIn personas; Lazarus Group also established email accounts to match those of the victim as part of their BEC attempt.

During SharePoint ToolShell Exploitation, threat actors created Proton mail accounts for communication with organizations infected with ransomware.

During Operation Honeybee, attackers created email addresses to register for a free account for a control server used for the implants.

For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.

During Operation AkaiRyū, MirrorFace used free email providers such as Gmail for spearphishing.

For FunnyDream, the threat actors likely established an identified email account to register a variety of domains that were used during the campaign.

During Salesforce Data Exfiltration, threat actors registered emails shinycorp@tuta[.]com and shinygroup@tuta[.]com to send victims extortion demands.

For Operation Wocao, the threat actors registered email accounts to use during the campaign.

Indrik Spider has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details.

Kimsuky has created email accounts for phishing operations.

EXOTIC LILY has created e-mail accounts to spoof targeted organizations.

Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.

CURIUM has created dedicated email accounts for use with tools such as IMAPLoader.

Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns. Mustang Panda has also created fake Google accounts to distribute malware via spear-phishing emails. Mustang Panda has also created accounts for spearphishing operations including the use of services such as Proton Mail.

Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services. Contagious Interview has also utilized fake email accounts with Threat Intelligence vendor services.

APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.

Leviathan has created new email accounts for targeting efforts.

Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.

Medusa Group has created email accounts used in ransomware negotiations.

Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.

APT42 has created email accounts to use in spearphishing operations.

Lazarus Group has created new email accounts for spearphishing operations.

Wizard Spider has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware.

Moonstone Sleet has created email accounts to interact with victims, including for phishing purposes.

VOID MANTICORE has created email accounts to send threatening messages to victims to include ‘Handala_Team[@]outlook[.]com’.

HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.

Magic Hound has established email accounts using fake personas for spearphishing operations.

ShinyHunters has established multiple email accounts, such as shinycorp@tutonota[.]com, for use in extortion activities.

During Operation AkaiRyū, MirrorFace established OneDrive accounts to host malicious payloads.

During Outer Space, OilRig created M365 email accounts to be used as part of C2.

Storm-1811 has created malicious accounts to enable activity via Microsoft Teams, typically spoofing various IT support and helpdesk themes.

Sandworm Team creates credential capture webpages to compromise existing, legitimate social media accounts.

Leviathan has compromised social media accounts to conduct social engineering attacks.

During Operation AkaiRyū, MirrorFace used compromised accounts to send spearphishing emails.

During Salesforce Data Exfiltration, threat actors used compromised emails to create Salesforce trial accounts.

Kimsuky has compromised email accounts to send spearphishing e-mails.

TA577 has sent thread hijacked messages from compromised emails.

Mustang Panda has compromised legitimate email accounts to use in their spear-phishing operations.

OilRig has compromised email accounts to send phishing emails.

Leviathan has compromised email accounts to conduct social engineering attacks.

APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.

Star Blizzard has used compromised email accounts to conduct spearphishing against
contacts of the original victim.

APT28 has used compromised email accounts to send credential phishing emails.

APT-C-36 has regularly used compromised email accounts in spearphishing campaigns.

LAPSUS$ has payed employees, suppliers, and business partners of target organizations for credentials.

IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.

HEXANE has used compromised accounts to send spearphishing emails.

WIRTE has used compromised emails, including one belonging to an Israel-based technology reseller, to deliver targeted spearphishing messages.

Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.

APT41 DUST used compromised Google Workspace accounts for command and control.