Spearphishing Link
Subtechnique · ATTACK:enterprise:T1598.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1598.003",
"title": "Spearphishing Link",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1598/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--2d3f5b3c-54ca-4f4d-bb1f-849346d31230",
"external_id": "T1598.003",
"domain": "enterprise",
"created": "2020-10-02T17:09:50.723Z",
"modified": "2026-05-12T15:12:00.624Z",
"version": "1.7",
"aliases": [
],
"tactics": [
"reconnaissance"
],
"source_references": [
{
"source_name": "ACSC Email Spoofing",
"url": "https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
},
{
"source_name": "TrendMictro Phishing",
"url": "https://www.trendmicro.com/en_us/research/20/i/tricky-forms-of-phishing.html"
},
{
"source_name": "IAPP",
"url": "https://iapp.org/resources/article/web-beacon/"
},
{
"source_name": "QR-campaign-energy-firm",
"url": "https://therecord.media/phishing-campaign-used-qr-codes-to-target-energy-firm"
},
{
"source_name": "PCMag FakeLogin",
"url": "https://www.pcmag.com/news/hackers-try-to-phish-united-nations-staffers-with-fake-login-pages"
},
{
"source_name": "Microsoft Anti Spoofing",
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
},
{
"source_name": "Mr. D0x BitB 2022",
"url": "https://mrd0x.com/browser-in-the-browser-phishing-attack/"
},
{
"source_name": "Mandiant URL Obfuscation 2023",
"url": "https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse"
},
{
"source_name": "NIST Web Bug",
"url": "https://csrc.nist.gov/glossary/term/web_bug"
},
{
"source_name": "Proofpoint Human Factor",
"url": "https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-human-factor-report.pdf"
},
{
"source_name": "Ryte Wiki",
"url": "https://en.ryte.com/wiki/Tracking_Pixel/"
},
{
"source_name": "qr-phish-agriculture",
"url": "https://www.proofpoint.com/us/blog/email-and-cloud-threats/cybersecurity-stop-month-qr-code-phishing"
},
{
"source_name": "ZScaler BitB 2020",
"url": "https://www.zscaler.com/blogs/security-research/fake-sites-stealing-steam-credentials"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--107dc621-6f5d-4b59-9873-54355e55312d
ATT Sidewinder January 2021ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--167c9690-53fa-4f54-a86c-971b70b62c82
Check Point Scattered Spider JUL 2025ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33ee917f-8624-4108-91fb-a87d576ac634
Proofpoint TA416 Europe March 2022ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3954c9eb-1916-43ed-ba79-cc40d084c1a0
US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:G0122 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44866cfd-7d8f-45f6-906b-5b4992aa69e0
DOJ Iran Indictments March 2018 · Phish Labs Silent Librarian · Secureworks COBALT DICKENS August 2018 · Proofpoint TA407 September 2019 · Secureworks COBALT DICKENS September 2019 · Malwarebytes Silent Librarian October 2020ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--545efdec-5375-43e9-b369-0f6367b067dd
AADInternals DocumentationATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59f80c0d-e8d7-48f6-960a-3d4b593f8b33
ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bb51393-199c-48a1-b1fd-7f851fee0562
Microsoft Targeting Elections September 2020ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bc091f3-0059-4eab-ab68-5e4474108fdf
Volexity Ocean Lotus November 2020ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f8667b5-b957-4f45-9c58-07321db8f62a
SOCRadar_ShinyHunters_Mar2024ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d101f53-3b5a-467a-aeb8-172cd77e92ce
EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 · FBI_KimsukyQR_Jan2026 · Malwarebytes Kimsuky June 2021 · VirusBulletin Kimsuky October 2019 · KISA Operation Muzabi · Proofpoint TA427 April 2024ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e03a9bc-a701-4797-8f0e-0eb17f32ddac
Google Iran Threats October 2021 · Certfa Charming Kitten January 2021 · ClearSky Kittens Back 3 August 2020 · Proofpoint TA453 July2021 · Proofpoint TA453 March 2021 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:S0649 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93885649-e686-4496-96fc-aa901e626ca5
FireEye Shining A Light on DARKSIDE May 2021ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9aa9b9f6-a22f-4763-a2ff-7635f5022727
US District Court Indictment GRU Oct 2018 · ESET Zebrocy May 2019 · Google TAG Ukraine Threat Landscape March 2022 · DOJ GRU Indictment Jul 2018 · Secureworks IRON TWILIGHT Active Measures March 2017ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af6b077e-6925-4551-8174-baee6efa050c
CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022 · StarBlizzard · Google TAG COLDRIVER January 2024ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5d1e525-1bb7-43a9-8cb6-0a8d9539b465
Microsoft Moonstone Sleet 2024ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb2d9a64-c36c-4998-9d31-5ad25629d288
PWC Yellow Liderc 2023ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd2f28c5-7687-4d74-b3ad-42d2d62e4548
US-CERT TA18-074AATTACK:enterprise:T1598.003 → subtechnique-of → ATTACK:enterprise:T1598
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d12eb6a1-bb15-4d95-8390-667cda87923e
ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6270a34-0a0b-456d-9857-f6fe0ec54ea8
Sophos Evilginx MAR 2025 · Breakdev Evilginx 2.3 JAN 2019 · Breakdev Evilginx 3.3 APR 2024ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9b4a18a-955a-4ef8-93b2-61db23e59b75
Volexity Patchwork June 2018ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe8f4b79-9495-4e08-b14e-d2954f847c78
ACSC Email Spoofing · Microsoft Anti Spoofing