Impersonation
Subtechnique · ATTACK:enterprise:T1684.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1684.001",
"title": "Impersonation",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1684/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--cd92d2b8-ce43-4666-9472-f1b4b9f4f8be",
"external_id": "T1684.001",
"domain": "enterprise",
"created": "2026-04-14T22:54:01.082Z",
"modified": "2026-05-12T15:12:00.717Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Crowdstrike BEC",
"url": "https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/business-email-compromise-bec/"
},
{
"source_name": "VEC",
"url": "https://www.cloudflare.com/learning/email-security/what-is-vendor-email-compromise/#:~:text=Vendor%20email%20compromise%2C%20also%20referred,steal%20from%20that%20vendor%27s%20customers."
}
]
}Explicit source assertions (27)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0029bcd7-f5f2-410e-84d4-39302d4d1b1f
Crowdstrike TELCO BPO Campaign December 2022ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--006e52ca-80ac-458a-943e-0595f570fe73
CISA Star Blizzard Advisory December 2023 · Microsoft Star Blizzard August 2022 · Google TAG COLDRIVER January 2024ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--020466ec-f701-4d9b-9fb7-4bcbc849069b
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09bef668-b821-4228-adb3-35a4605ac3e9
CloudSEK_RustyWater_Jan2026ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21f3796d-3dd7-4b43-bd80-ec75ef3edfef
FBI_KimsukyQR_Jan2026 · NaumaanProofpoint_GlobalClickFix_April2025ATTACK:enterprise:S1131 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--388ca51d-46e3-45bd-bf43-7ce4da109f8b
Huntress NPPSPY 2022ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45263d4b-48de-4c14-a90b-2de28daad829
Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025 · LevelBlue Blind Eagle Proton66 JUN 2025 · Zscaler BlindEagle DEC 2025ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--492f94b3-6076-40ee-87be-6b26880a6dce
FBI IC3 Flash VOID MANTICORE Handala Hack March 2026ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b8730a2-45ea-4811-aabd-a764cc0261a9
ESET MirrorFace DEC 2022ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d21c6ae-3b8b-4c3d-b71d-6d324ef80fa9
CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025 · MSTIC Octo Tempest Operations October 2023ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61035d89-bac7-4267-829f-a898eeb41f11
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64228637-0b64-45f6-b2e9-9601679576e1
Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cc7ee03-da28-4445-acd3-ce787b0ae61e
Microsoft CYBERWARCON NOV 2024ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fc6386b-9e04-4f20-aae6-a18ae3025391
TAG APT42 · Mandiant APT42-charmsATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fe65298-7e59-4d1d-851a-d6cb38e78795
CheckPoint_NimbusManticoreEurope_Sept2025 · CheckPoint_NimbusManticore_May2026 · Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024ATTACK:enterprise:S9064 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--713877d8-6ace-4489-bb26-e9eabc793808
Mandiant_UNC1549_Nov2025ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71db0201-9d27-4c74-a242-198dccbac5ad
ESET Lazarus Jun 2020 · ClearSky Lazarus Aug 2020 · The Hacker News Lazarus Aug 2022ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74a8ec0f-20d4-4175-bfc3-517d57956eff
ATTACK:enterprise:T1684.001 → subtechnique-of → ATTACK:enterprise:T1684
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--877db5e8-76f5-4af9-9f3a-48464f8a39ac
ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b3cbcdd-bbe0-4e98-bef6-c81b1549f625
Microsoft Storm-1811 2024ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8da03207-ceff-4791-ab21-730b0445fe6f
CloudSEK_RustyWater_Jan2026 · NaumaanProofpoint_GlobalClickFix_April2025ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93746e56-c2da-4186-acad-3a212537d764
Sentinel One Contagious Interview ClickFix September 2025 · Validin Contagious Interview North Korea ClickFix January 2025 · Socket HexEval BeaverTail Contagious Interview June 2025 · SecurityScorecard Contagious Interview October 2024 · Securonix Contagious Interview DEVPOPPER April 2024 · SecurityScorecard Contagious Interview FamousChollima October 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024ATTACK:enterprise:M1019 → mitigates → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9fbfdfe8-abe8-4c09-9d34-f0825b061cfa
ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3827f83-e909-4911-87ca-af039b369480
Check Point Wirte NOV 2024ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca441f47-97e7-4cc3-91af-a75d3aa45f72
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce372e4d-0174-4561-be4b-0d986c6d71bf
apt41_mandiantATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1684.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd3ff9c1-b745-44b1-8a28-3fb4a12134c7
Cato LAMEHUG JUL 2025