Spearphishing Attachment

From attackics
Jump to navigation Jump to search
Spearphishing Attachment
Technique
ID T0865
Tactic Initial Access
Data Sources File monitoring, Packet capture, Network intrusion detection system, Detonation chamber, Email gateway, Mail server
Asset Engineering Workstation, Human-Machine Interface, Control Server, Data Historian

Description

Adversaries may use a spearphishing attachment, a variant of spearphishing, as a form of a social engineering attack against specific targets. Spearphishing attachments are different from other forms of spearphishing in that they employ malware attached to an email. All forms of spearphishing are electronically delivered and target a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution and access.1


Procedure Examples

  • ALLANITE utilized spear phishing to gain access into energy sector environments.2
  • APT33 sent spear phishing emails containing links to HTML application files, which were embedded with malicious code.3 APT33 has conducted targeted spear phishing campaigns against U.S. government agencies and private sector companies.4
  • Dragonfly 2.0 used the Phishery tool kit to conduct spear phishing attacks and gather credentials.56 Dragonfly 2.0 conducted a targeted spear phishing campaign against multiple electric utilities in the North America.78
  • Dragonfly sent pdf documents over email which contained links to malicious sites and downloads.9
  • HEXANE has used malicious documents to drop malware and gain access into an environment.10
  • Lazarus group has been observed targeting organizations using spearphishing documents with embedded malicious payloads.11 Highly targeted spear phishing campaigns have been conducted against a U.S. electric grid company.12
  • OilRig used spearphishing emails with malicious Microsoft Excel spreadsheet attachments.13
  • The Backdoor.Oldrea RAT is distributed through a trojanized installer attached to emails.14
  • BlackEnergy targeted energy sector organizations in a wide reaching email spearphishing campaign. Adversaries utilized malicious Microsoft Word documents attachments.15

Mitigations

  • Network Intrusion Prevention - Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.
  • Restrict Web-Based Content - Consider restricting access to email within critical process environments. Additionally, downloads and attachments may be disabled if email is still necessary.
  • User Training - Users can be trained to identify social engineering techniques and spearphishing emails.


References