Procedure examples

Kimsuky has compromised email accounts to send spearphishing e-mails.

TA577 has sent thread hijacked messages from compromised emails.

Mustang Panda has compromised legitimate email accounts to use in their spear-phishing operations.

OilRig has compromised email accounts to send phishing emails.

Leviathan has compromised email accounts to conduct social engineering attacks.

APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.

Star Blizzard has used compromised email accounts to conduct spearphishing against
contacts of the original victim.

APT28 has used compromised email accounts to send credential phishing emails.

APT-C-36 has regularly used compromised email accounts in spearphishing campaigns.

LAPSUS$ has payed employees, suppliers, and business partners of target organizations for credentials.

IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.

HEXANE has used compromised accounts to send spearphishing emails.

WIRTE has used compromised emails, including one belonging to an Israel-based technology reseller, to deliver targeted spearphishing messages.

Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.