Spearphishing Voice
Subtechnique · ATTACK:enterprise:T1598.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1598.004",
"title": "Spearphishing Voice",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1598/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--6a5d222a-a7e0-4656-b110-782c33098289",
"external_id": "T1598.004",
"domain": "enterprise",
"created": "2023-09-07T21:48:39.516Z",
"modified": "2026-05-12T15:12:00.640Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"reconnaissance"
],
"source_references": [
{
"source_name": "Avertium callback phishing",
"url": "https://www.avertium.com/resources/threat-reports/everything-you-need-to-know-about-callback-phishing"
},
{
"source_name": "BOA Telephone Scams",
"url": "https://business.bofa.com/en-us/content/what-is-vishing.html"
}
]
}Explicit source assertions (6)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1598.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1769fb21-c686-4af1-ba8f-8bfa48ecf585
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:T1598.004 → subtechnique-of → ATTACK:enterprise:T1598
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bdb0dad-0c0c-4ced-bac1-8a9c5c89bb09
ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1598.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60fc3c88-bff5-4a06-88f3-15715e4cafda
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1598.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72d641a0-126d-4bb2-98de-9f8ec46a8d9d
CISA PhishingATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1598.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db256e63-e369-4fc4-985a-ce830f4292b9
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1598.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dbec2814-4a92-4ab7-a007-123b40b16d0b
CrowdStrike Scattered Spider JUL 2025 · Mandiant VMware vSphere JUL 2025 · MSTIC Octo Tempest Operations October 2023