TA577G1037 ↗
Has sent thread hijacked messages from compromised emails.1
- Tactic
- Resource Development
- Platform
- PRE
- Version
- 1.1
- Created
- 01 October 2020
- Last modified
- 12 May 2026
- Contributors
- Tristan Bennett, Seamless Intelligence; Bryan Onel
Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
14
Threat groupsTop 13%
Threat groups87th percentile · 87% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Email Accounts MITRE reference T1586.002
Top 13%of all ATT&CK techniques for number of groups
14 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Star BlizzardG1033 ↗
Has used compromised email accounts to conduct spearphishing against contacts of the original victim.1
LAPSUS$G1004 ↗
Has payed employees, suppliers, and business partners of target organizations for credentials.12
IndigoZebraG0136 ↗
Has compromised legitimate email accounts to use in their spearphishing operations.1
Mustang PandaG0129 ↗
Has compromised legitimate email accounts to use in their spear-phishing operations.1
APT-C-36G0099 ↗
Has regularly used compromised email accounts in spearphishing campaigns.12
All 14 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Salesforce Data ExfiltrationC0059 ↗
During Salesforce Data Exfiltration, threat actors used compromised emails to create Salesforce trial accounts.1
Operation AkaiRyūC0060 ↗
During Operation AkaiRyū, MirrorFace used compromised accounts to send spearphishing emails.1
All 2 campaigns for this technique
Offense vs defense T1586.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Email Accounts detection strategy DET0861
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Email Accounts
1 platform
AN1993 · PRE
Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Phishing).
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.