Spearphishing via Service
Subtechnique · ATTACK:enterprise:T1566.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1566.003",
"title": "Spearphishing via Service",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1566/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--f6ad61ee-65f3-4bd0-a3f5-2f0accb36317",
"external_id": "T1566.003",
"domain": "enterprise",
"created": "2020-03-02T19:24:00.951Z",
"modified": "2025-10-24T17:49:37.487Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"initial-access"
],
"source_references": [
{
"source_name": "Lookout Dark Caracal Jan 2018",
"url": "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06a1f6f9-0695-47e6-bf1b-363d435d0bb2
Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11643b79-aef3-4322-ab3c-06f6569a1583
ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--241c2c47-3659-4899-bf5b-64f0ed94c916
SANS Windshift August 2018ATTACK:enterprise:G0130 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25424268-9ffb-40ed-8335-249deea323ca
FireEye Operation Saffron Rose 2013ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25527270-616e-4c53-a85a-03fc0b1e9a96
Google EXOTIC LILY March 2022ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--311f8c01-21ac-48db-a036-581e9e49f07c
ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43411790-39ce-4c88-aff0-1c53631fd130
Sekoia ClickFake 2025 · Validin Contagious Interview North Korea ClickFix January 2025 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · SecurityScorecard Contagious Interview October 2024 · SecurityScorecard Contagious Interview FamousChollima October 2024ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46b26f19-5b16-4cd9-b031-2eae4910dd3e
Kaspersky ToddyCat June 2022ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--586d0572-cf64-4cc3-93a3-4ee11b49e9cd
Kaspersky ToddyCat June 2022ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c1c0c1e-91fb-4285-9656-8d452e630fb3
ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d2db35f-33b3-4659-b707-770fc1630dd6
Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79cf4f25-6d05-4756-a671-2d578c6db184
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:M1021 → mitigates → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f18d24e-fffe-413f-96ff-612b3e9bedd6
ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95914d60-80b6-432b-945a-316b93cb2a13
Security Intelligence More Eggs Aug 2019ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b91755d-2b83-438c-bd25-0e71c540310a
ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0f6cf11-a8ac-4aba-a540-6bfa2b722f9c
MSTIC NOBELIUM May 2021ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3d6abc5-11da-4d0c-a699-8cafac03dfab
FireEye APT34 July 2019ATTACK:enterprise:G0070 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4174e7a-3b60-4697-a006-84edb81622cd
Lookout Dark Caracal Jan 2018ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba9b20fb-04a8-403b-9549-c13a9bb2603c
Google TAG Lazarus Jan 2021ATTACK:enterprise:T1566.003 → subtechnique-of → ATTACK:enterprise:T1566
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7ab9f46-f60e-4156-b56f-415e39bc7dd9
ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ceffc6ab-75ce-4efa-97f7-c1cd9a82385a
Microsoft Storm-1811 2024ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d432f9c7-1211-4485-bac3-b35edc38d501
SecureWorks Mia Ash July 2017 · Microsoft Phosphorus Mar 2019 · ClearSky Kittens Back 3 August 2020ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--efd13110-1e89-4e99-b015-4e09046f2b73
Microsoft Moonstone Sleet 2024