Internal Spearphishing
Technique · ATTACK:enterprise:T1534
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1534",
"title": "Internal Spearphishing",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1534",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--9e7452df-5144-4b6e-b04a-b66dd4016747",
"external_id": "T1534",
"domain": "enterprise",
"created": "2019-09-04T19:26:12.441Z",
"modified": "2026-05-12T15:12:00.706Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"lateral-movement"
],
"source_references": [
{
"source_name": "Int SP - chat apps",
"url": "https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/"
},
{
"source_name": "Trend Micro - Int SP",
"url": "https://www.trendmicro.com/en_us/research.html"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--109bbda3-f97a-4067-81d6-ed635f251282
ESET Gamaredon June 2020ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d4ecf70-a573-4a8d-889d-c0f296399977
FalconFeeds_Iran_Mar2026ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31f9cd5d-bfb6-4764-a724-8e8f131099d1
KISA Operation MuzabiATTACK:enterprise:S9030 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--454f19f9-c9bf-427b-9ba1-f1c57ce48768
Check Point Wirte NOV 2024ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ef76744-096e-495e-b96a-1fdb5d6e9108
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7064e494-5a32-4a40-b0b1-b19b9a145e73
ClearSky Lazarus Aug 2020ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96ebe8fc-85be-4652-b6dd-24f318b83129
Zscaler BlindEagle DEC 2025ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c00b008a-5f2c-4837-811b-21193b70b4ae
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6a8aba6-d711-45bd-a99e-7a12b8c72ae0
SecureWorks August 2019