Real-world descriptions of how a group, tool or campaign used a technique.
20 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1585.002 Email Accounts |
GroupIndrik Spider | Indrik Spider has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details. |
| T1585.002 Email Accounts |
GroupKimsuky | Kimsuky has created email accounts for phishing operations. |
| T1585.002 Email Accounts |
GroupEXOTIC LILY | EXOTIC LILY has created e-mail accounts to spoof targeted organizations. |
| T1585.002 Email Accounts |
GroupSandworm Team | Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations. |
| T1585.002 Email Accounts |
GroupCURIUM | CURIUM has created dedicated email accounts for use with tools such as IMAPLoader. |
| T1585.002 Email Accounts |
GroupMustang Panda | Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns. Mustang Panda has also created fake Google accounts to distribute malware via spear-phishing emails. Mustang Panda has also created accounts for spearphishing operations including the use of services such as Proton Mail. |
| T1585.002 Email Accounts |
GroupContagious Interview | Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services. Contagious Interview has also utilized fake email accounts with Threat Intelligence vendor services. ESET Contagious Interview BeaverTail InvisibleFerret February 2025PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025Sentinel One Contagious Interview ClickFix September 2025Socket HexEval BeaverTail Contagious Interview June 2025Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 |
| T1585.002 Email Accounts |
GroupAPT1 | APT1 has created email accounts for later use in social engineering, phishing, and when registering domains. |
| T1585.002 Email Accounts |
GroupLeviathan | Leviathan has created new email accounts for targeting efforts. |
| T1585.002 Email Accounts |
GroupSilent Librarian | Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts. |
| T1585.002 Email Accounts |
GroupMedusa Group | Medusa Group has created email accounts used in ransomware negotiations. |
| T1585.002 Email Accounts |
GroupStar Blizzard | Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target. |
| T1585.002 Email Accounts |
GroupAPT42 | APT42 has created email accounts to use in spearphishing operations. |
| T1585.002 Email Accounts |
GroupLazarus Group | Lazarus Group has created new email accounts for spearphishing operations. |
| T1585.002 Email Accounts |
GroupWizard Spider | Wizard Spider has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware. |
| T1585.002 Email Accounts |
GroupMoonstone Sleet | Moonstone Sleet has created email accounts to interact with victims, including for phishing purposes. |
| T1585.002 Email Accounts |
GroupVOID MANTICORE | VOID MANTICORE has created email accounts to send threatening messages to victims to include ‘Handala_Team[@]outlook[.]com’. |
| T1585.002 Email Accounts |
GroupHEXANE | HEXANE has established email accounts for use in domain registration including for ProtonMail addresses. |
| T1585.002 Email Accounts |
GroupMagic Hound | Magic Hound has established email accounts using fake personas for spearphishing operations. |
| T1585.002 Email Accounts |
GroupShinyHunters | ShinyHunters has established multiple email accounts, such as shinycorp@tutonota[.]com, for use in extortion activities. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
