APT-C-36G0099 ↗
Has used a compromised account to send a phishing email to an address likely used and monitored by the IT team within the same targeted organization.1
tfMITRE ATT&CK technique
Internal Spearphishing T1534
- Tactic
- Lateral Movement
- Platforms
- Linux, macOS, Office Suite, SaaS, Windows
- Version
- 1.4
- Created
- 04 September 2019
- Last modified
- 12 May 2026
- Contributors
- Tim MalcomVetter; Swetha Prabakaran, Microsoft Threat Intelligence Center (MSTIC)
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating Impersonation.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
6
Threat groupsTop 25%
Threat groups75th percentile · 73% of ATT&CK techniques have fewer threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.