Spearphishing Attachment

To visit this technique’s new page please go to and update your links to https://attack.mitre.org/techniques/T0865

Spearphishing Attachment
Technique
ID	T0865
Tactic	Initial Access
Data Sources	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Asset	Engineering Workstation, Human-Machine Interface, Control Server, Data Historian

Description

Adversaries may use a spearphishing attachment, a variant of spearphishing, as a form of a social engineering attack against specific targets. Spearphishing attachments are different from other forms of spearphishing in that they employ malware attached to an email. All forms of spearphishing are electronically delivered and target a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution and access.1

A Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012, targeted ONG organizations and their employees. The emails were constructed with a high level of sophistication to convince employees to open the malicious file attachments.2

Procedure Examples

• ALLANITE utilized spear phishing to gain access into energy sector environments.3
• APT33 sent spear phishing emails containing links to HTML application files, which were embedded with malicious code.4 APT33 has conducted targeted spear phishing campaigns against U.S. government agencies and private sector companies.5
• Dragonfly 2.0 used the Phishery tool kit to conduct spear phishing attacks and gather credentials.67 Dragonfly 2.0 conducted a targeted spear phishing campaign against multiple electric utilities in the North America.89
• Dragonfly conducted a targeted phishing campaign against energy sector executives and senior personnel. Deceptive subject lines were used to portray a high importance. Malicious PDFs were then used to infect the user’s device.10
• HEXANE has used malicious documents to drop malware and gain access into an environment.11
• Lazarus group has been observed targeting organizations using spearphishing documents with embedded malicious payloads.12 Highly targeted spear phishing campaigns have been conducted against a U.S. electric grid company.13
• OilRig used spearphishing emails with malicious Microsoft Excel spreadsheet attachments.14
• In the Ukraine 2015 incident, Sandworm Team sent spearphishing attachments to three energy distribution companies containing malware to gain access to victim systems.15
• The Backdoor.Oldrea RAT is distributed through a trojanized installer attached to emails.16
• BlackEnergy targeted energy sector organizations in a wide reaching email spearphishing campaign. Adversaries utilized malicious Microsoft Word documents attachments.17

Mitigations

• Antivirus/Antimalware - Deploy anti-virus on all systems that support external email.

• Network Intrusion Prevention - Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.

• Restrict Web-Based Content - Consider restricting access to email within critical process environments. Additionally, downloads and attachments may be disabled if email is still necessary.

• User Training - Users can be trained to identify social engineering techniques and spearphishing emails.

References

1. ^  Enterprise ATT&CK. (2019, October 25). Spearphishing Attachment. Retrieved October 25, 2019.
2. ^  Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA). (2021, July 20). Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013. Retrieved October 8, 2021.
3. ^  Jeff Jones. (2018, May 10). Dragos Releases Details on Suspected Russian Infrastructure Hacking Team ALLANITE. Retrieved January 3, 2020.
4. ^  Jacqueline O'Leary et al.. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved December 2, 2019.
5. ^  Andy Greenburg. (2019, June 20). Iranian Hackers Launch a New US-Targeted Campaign as Tensions Mount. Retrieved January 3, 2020.
6. ^  Symantec. (2017, September 6). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 14, 2017.
7. ^  Sean Baird, Earl Carter, Erick Galinkin, Christopher Marczewski & Joe Marshall. (2017, July 07). Attack on Critical Infrastructure Leverages Template Injection. Retrieved December 5, 2019.
8. ^  Dragos Threat Intelligence. (2018, September 17). THREAT INTELLIGENCE SUMMARY TR-2018-25: Phishing Campaign Targeting Electric Utility Companies. Retrieved January 3, 2020.
9. ^  Dragos Threat Intelligence. (2018). ICS Activity Groups and Threat Landscape. Retrieved January 3, 2020.

10. ^  Symantec Security Response. (2014, July 7). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
11. ^  Dragos. (n.d.). Hexane. Retrieved October 27, 2019.
12. ^  Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
13. ^  Eduard Kovacs. (2018, March 1). Five Threat Groups Target Industrial Systems: Dragos. Retrieved January 3, 2020.
14. ^  Robert Falcone, Bryan Lee. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved November 19, 2019.
15. ^  UNITED STATES DISTRICT COURT WESTERN DISTRICT OF PENNSYLVANIA. (2020, October 15). Indictment: Conspiracy to Commit an Offense Against the United States. Retrieved April 7, 2021.
16. ^  Daavid Hentunen, Antti Tikkanen. (2014, June 23). Havex Hunts For ICS/SCADA Systems. Retrieved April 1, 2019.
17. ^  Booz Allen Hamilton. (n.d.). When The Lights Went Out. Retrieved October 22, 2019.