THREATNOIR
Subscribe
MITRE ATT&CK · T1534

Internal Spearphishing

MITRE · cited in 5 of our lessons

Explanation

What attackers do. After gaining access to an internal account, attackers send phishing messages from it to colleagues, who are more likely to trust a message from a known address. This serves the Lateral Movement tactic.

How to defend. Apply the same filtering to internal mail and chat as to external mail, protect accounts with phishing-resistant MFA and monitor for compromised mailboxes. Make it easy to report suspicious internal messages and act quickly to contain the sending account. Revoke sessions and reset credentials for the sending account as soon as compromise is confirmed.

Signs to look for. Look for internal accounts sending unusual volumes of messages, messages with links or attachments unlike the sender's normal pattern, and new inbox rules hiding replies. A common gap is internal mail bypassing security scanning.

Open the technique on MITRE ATT&CK
The official text
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation. For example, adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.