Email Accounts
Subtechnique · ATTACK:enterprise:T1585.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1585.002",
"title": "Email Accounts",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1585/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--65013dd2-bc61-43e3-afb5-a14c4fa7437a",
"external_id": "T1585.002",
"domain": "enterprise",
"created": "2020-10-01T01:09:53.217Z",
"modified": "2026-09-11T19:22:11.810Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "Trend Micro R980 2016",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/r980-ransomware-disposable-email-service/"
},
{
"source_name": "Free Trial PurpleUrchin",
"url": "https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/"
},
{
"source_name": "Mandiant APT1",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
}
]
}Explicit source assertions (31)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02838a73-1e42-4fda-a27b-044d14f303d9
McAfee HoneybeeATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09583053-9fab-47bb-b07c-76d75cbb5c30
KISA Operation Muzabi · Proofpoint TA427 April 2024 · Mandiant APT43 March 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--144d9006-95ab-4d14-8243-5c7e035d930c
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a163c8a-7a12-4cd4-813f-38f5a05ba98d
Proofpoint TA453 March 2021 · IBM ITG18 2020ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23c5db03-ed4a-4021-835f-32f719e4bd9c
Google Salesforce JUN 2025 · Unit42KelleyVaya_BlingLibra_Aug2024ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27257b64-c32c-49cd-a4ce-f804c251829d
FoxIT Wocao December 2019ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a13b64a-2173-4565-aca6-bbf3edfdc499
ESET Lazarus Jun 2020ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a3956aa-6756-4682-aa1b-c5199c0f3540
IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Proofpoint TA416 Europe March 2022ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42d82e3f-b6cf-4624-a2bc-22e32c665f2e
MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:T1585.002 → subtechnique-of → ATTACK:enterprise:T1585
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--579bdadc-b080-49f1-be32-283b06444569
ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cc7c5ef-f170-4147-8703-03ea34d40d12
CISA AA21-200A APT40 July 2021ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f7853bd-a4d6-418f-8d23-d24fc32dffa0
Google Salesforce JUN 2025ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--780f7b55-e82f-4c62-85af-316c817f1cc4
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78dd8fdb-51c9-475b-af74-0acd1c0a0969
CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022 · Google TAG COLDRIVER January 2024ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b5386dc-ebc3-4acd-ad70-833ed3fedd61
TAG APT42ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e1510d2-b080-40a9-af8d-06e6b30a796b
PWC Yellow Liderc 2023ATTACK:enterprise:G0122 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83219112-6e5b-43ea-a7a7-78213f28397f
DOJ Iran Indictments March 2018ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88d72a6e-091f-48ff-9ad4-fd05d748d956
Google EXOTIC LILY March 2022ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d4579a3-aa24-4bfa-b567-8116fdbc2569
Palo Alto SharePoint Vulnerabilities JUL 2025ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b14bfc1-2c78-4ec9-ad02-aeed6f1cf83e
Mandiant APT1ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e7ff28c-3c76-488d-8fb3-623a19ee55c1
ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a28b6a04-5562-4550-91bd-6397c0c9fe3f
Mandiant FIN12 Oct 2021ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad5e568c-376c-4ab8-be50-e965feb0c160
Kaspersky Lyceum October 2021ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc156b29-534a-4156-b188-8f4a426a0e6c
Crowdstrike Indrik November 2018ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3ac0edb-8e56-440f-a844-be61b6045901
US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:C0007 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d992890d-5725-4bed-8d33-51dfbff77087
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc64a0c1-9302-4816-8b1d-b6b348f12efb
Cylance Dust StormATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e325701b-8622-40b6-aca7-31ae27633bf5
DOJ FBI Handala Hack March 2026ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9575965-967c-46fc-bfda-9305c29b045c
Sentinel One Contagious Interview ClickFix September 2025 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · Socket HexEval BeaverTail Contagious Interview June 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eea8a891-7ebb-4589-9d36-6a801ff00818
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f58e5c25-e80b-45fb-8eb4-61daa2256842
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024