Technique
technique:phishing
Also: P-H-I-S-H, classic phishing scheme, e-mail phishing, phish, phishing attack, phishing e-mail, phishing e-mails, phishing email, phishing emails, phishing lures, phishing messages, phishing methods, phishing page, phishing text message, spear phishing
Social-engineering technique used during the campaign; a hospital employee clicked a phishing email, enabling access to the hospital mail server.
Social-engineering technique used during the campaign; a hospital employee clicked a phishing email, enabling access to the hospital mail server.
“They were sending in a lot of spam e-mails too, and phishing e-mails.”
Initial-access technique considered likely by the incident responder, involving malicious links or documents sent to employees.
“I came in with a phish only because there was very little exploitation of systems”
“Phishing is when a hacker targets an employee”
Targeted social-engineering technique in which attackers researched a victim and spoofed a familiar coworker’s email to induce a link click.
“Then they would send a phishing e-mail to the target.”
“the hacker spoofed an e-mail to make it look like it came from that co-worker”
Use of deceptive email to induce a user to click something and enable access to their machine.
“Set up a phish, get our phish ready”
“A phish is an e-mail that is designed to trick the user”
Technique described as the likely initial access method, using a targeted email containing a malicious attachment or link.
“The attackers likely got in through a phishing e-mail.”
“they’d send a specific employee an e-mail with an interesting attachment or link.”
Fraudulent messages and cloned login pages used to obtain account credentials.
“the link is to the hacker’s server and not Google”
“sending phishing e-mails to get into their iCloud logins”
Use of a deceptive email and attachment to gain the first foothold in a bank.
“They send a spare phishing e-mail to an employee at the bank”
Deceptive email activity used as a scenario for obtaining an employee-level foothold.
“When a phish or phishing e-mail is successful”
Use of a deceptive, targeted email to persuade a recipient to assist the attackers.
“we put a phish together, a phishing e-mail with a domain that looked a lot like our target company’s domain”
“This one is extremely personal and targeted.”
Technique involving deceptive emails, links, or messages used to induce targets to interact with attacker-controlled content.
“set up a phishing e-mail and use Metasploit to gain access”
“phishing e-mails from so-called activists”
Technique described in attacks against Indian embassies and Pakistani companies.
“These are e-mail phishing attempts with nasty malware attached”
Use of a document sent to a suspect to induce opening and generate a network callback for attribution.
“social engineering and phishing methods for good”
Technique using deceptive electronic messages or pages to induce users to click links, disclose credentials, or execute software.
“An e-mail designed to get you to click a link in there which will harm you somehow”
“our goal is to steal credentials, to install an implant to get a trojan or malware on the machine”
Social-engineering technique practiced by ETA members.
“and phishing”
Use of deceptive email attachments, including job-application CV archives, to infect Bangladesh Bank employees.
“they get the classic phishing e-mail; it’s a zip file that contains a CV”
Technique used to send malicious Word documents or emails to Olympic-related targets and obtain initial code execution.
“sending out infected Word documents, attachments designed to give them some sort of code execution”
“the initial infection of the Olympic network began with a phishing e-mail”
Use of deceptive e-mails and links to induce targets to visit attacker-controlled login pages or disclose credentials.
“it looked like a somewhat convincing phishing e-mail”
“the goal, to get you to enter your password.”
Fraudulent messages and websites used to collect account credentials and payment-card information.
“Someone sent him a phishing e-mail and he fell for it.”
“Cam’s phishing scam was to tell people they needed to update their account details on PayPal.”
Use of targeted emails or documents to lure victims into opening malicious attachments or links.
“we started noticing some interesting-looking phishing lures”
“The phishing e-mails were written in Arabic”
A method Jenny mentions as a way to target people remotely through their networks.
“We can just phish people or whatever.”
Using an enticing message or crafted stanza to induce a Kik user to open a link that exposes information about the user.
“a classic phishing scheme”
“I plug in my link to the stanza”
Attack method mentioned as a way of establishing a fraudulent website or stealing Bitcoin from NiceHash.
“If you’re creating a phishing attack, you have to set up a website that looks like Bank of America.”
“Iserdo said they were victim to a phishing attack.”
A social-engineering technique mentioned as part of the operators' skill set.
“the social engineering, phishing, stuff like that”
Use of deceptive messages or links to induce a target to click and begin device compromise.
“The point of all these messages were simply to get someone to tap on the link on their phone.”
Use of deceptive electronic messages or pages to test or induce employee actions, including credential submission.
“security awareness training and then social engineering assessments and testing, phishing”
“send phishing e-mails to all employees”
Use of deceptive email messages and attachments to induce an employee to execute malware or reveal account-reset codes.
“it started with a phishing e-mail”
“We called them all up, pretending to be from Google”
Use of deceptive emails to induce users to click links or attachments that install malware.
“Pushdo would infect machines through phishing e-mails”
Use of fraudulent websites or messages to collect payment-card, account, or wallet information.
“It’s a phishing page.”
Use of deceptive emails, attachments, or links to compromise employees and obtain initial access.
“Employees at NiceHash start to get phishing e-mails sent to them”
“the classic way in, of course”
Use of phishing emails to compromise banking employees before attacking bank systems and SWIFT transactions.
“usually sending phishing e-mails to banking employees”
Social-engineering technique used against Business Wire employees to seek malware installation or credential theft.
“Business Wire employees received a rash of phishing e-mails”
“including brute force attacks, SQL injection attacks, and phishing”
Fraudulent communication technique used to induce a victim to take an action or disclose information.
“BEC is basically a phishing attack”
Credential-stealing technique used by a Welcome to Video user who impersonated a moderator or help-desk administrator.
“He was actually just phishing people, essentially, on Welcome to Video”
“pretending to be a moderator and then stealing their credentials”
Initial-access technique involving deceptive emails, links, attachments, or impersonation of trusted contacts.
“They were attacking government organizations through phishing”
“hundreds of phishing attempts”
Social-engineering delivery method using plausible urgent messages and links to induce a target to click.
“the victim would receive a phishing text message”
Email-based deception discussed as an overarching category that can include requests for money, credential theft, or malicious links.
“phishing is kind of the overarching term for any e-mail-based threat like that”
Use of deceptive emails and documents to compromise bank or company employees.
“sent them a phishing e-mail, got them to open a PDF”
User-targeted delivery method described as the usual way ransomware spread at the time.
“it was mostly spread by phishing e-mail”
Social-engineering technique used to target private investigators and obtain access to their computers or accounts.
“I used that to do phishing. I was phishing them to a malware”
Use of deceptive email and online advertisements to distribute Bayrob or recruit money mules.
“specifically through phishing e-mails and Craigslist posts”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Malicious Macro Generator | Explicit | 77 |
| incoming | INVOLVES | #OpJustina | Explicit | 14 |
| incoming | USES | Anonymous | Explicit | 14 |
| incoming | INITIAL_ACCESS_VIA | Boston Children’s Hospital network attack | Explicit | 14 |
| incoming | INITIAL_ACCESS_VIA | Retail credit-card breach | Uncertain | 15 |
| incoming | INVOLVES | Operation Aurora | Explicit | 19 |
| incoming | INITIAL_ACCESS_VIA | Operation Aurora | Explicit | 19 |
| incoming | USES | Snow | Explicit | 22 |
| incoming | INITIAL_ACCESS_VIA | Saudi Aramco cyber-attack (2012) | Uncertain | 30 |
| incoming | INITIAL_ACCESS_VIA | Apple iCloud phishing campaign | Explicit | 34 |
| incoming | INITIAL_ACCESS_VIA | Carbanak | Explicit | 35 |
| incoming | USES | JekHyde | Explicit | 41 |
| incoming | INITIAL_ACCESS_VIA | JekHyde and Carl physical penetration engagement | Derived | 41 |
| incoming | USES | Project Raven | Explicit | 47 |
| incoming | INVOLVES | India-Pakistan cyber-conflict | Explicit | 51 |
| incoming | USES | John Strand | Explicit | 67 |
| incoming | USES | Social Engineer LLC | Explicit | 69 |
| incoming | USES | Christopher Hadnagy | Explicit | 69 |
| incoming | USES | Electronik Tribulation Army | Explicit | 70 |
| incoming | INITIAL_ACCESS_VIA | Bangladesh Bank heist | Explicit | 72 |
| incoming | INITIAL_ACCESS_VIA | Olympic Destroyer | Explicit | 77 |
| incoming | USES | Dark Basin | Explicit | 79 |
| incoming | USES | BellTroX InfoTech Services | Explicit | 79 |
| incoming | USES | Cameron Harrison | Explicit | 85 |
| incoming | USES | Molerats | Derived | 89 |
| incoming | USES | Jenny Radcliffe | Explicit | 90 |
| incoming | USES | Azrael | Explicit | 93 |
| incoming | USES | Jonathan Studebaker | Explicit | 95 |
| incoming | USES | Alethe Denis | Explicit | 107 |
| incoming | USES | TeaMp0isoN | Explicit | 109 |
| incoming | INITIAL_ACCESS_VIA | P. Diddy hotel compromise | Explicit | 109 |
| incoming | USES | Drew | Explicit | 112 |
| incoming | INITIAL_ACCESS_VIA | NiceHash hack | Explicit | 119 |
| incoming | INVOLVES | Kuwait bank robbery report | Derived | 120 |
| incoming | INVOLVES | Newswire hacking and insider-trading scheme | Explicit | 123 |
| incoming | INVOLVES | Evaldas Rimasauskas BEC scam | Explicit | 124 |
| incoming | INVOLVES | Welcome to Video investigation and takedown | Explicit | 131 |
| incoming | INITIAL_ACCESS_VIA | Costa Rica ransomware attack | Explicit | 135 |
| incoming | INITIAL_ACCESS_VIA | The D.R. Incident | Explicit | 135 |
| incoming | USES | Predator | Explicit | 137 |
| incoming | ASSOCIATED_WITH | Business E-mail Compromise | Explicit | 141 |
| incoming | USES | Chris Rock | Explicit | 151 |
| incoming | USES | Hieu Minh Ngo | Explicit | 162 |
| incoming | USES | Bayrob | Explicit | 175 |
#OpJustina INVOLVES phishing
The campaign involved phishing emails that were used to gain access to the hospital’s mail server.
Explicit Confidence 98% · Jack Rhysider EP 14 Details
“They were sending in a lot of spam e-mails too, and phishing e-mails.”
Attackers associated with Anonymous used phishing emails during the campaign.
Explicit Confidence 95% · Jack Rhysider EP 14 Details
“They were sending in a lot of spam e-mails too, and phishing e-mails.”
Boston Children’s Hospital network attack INITIAL_ACCESS_VIA phishing
Initial access to the hospital’s mail server was obtained after an employee clicked a phishing email.
Explicit Confidence 99% · Jack Rhysider EP 14 Details
“At some point an employee of the hospital clicked on a phishing e-mail and hackers were able to get into the hospital’s mail server.”
Retail credit-card breach INITIAL_ACCESS_VIA phishing
Matt personally believed the attackers probably entered through a phishing message, but he presented this as uncertain rather than confirmed.
Uncertain Confidence 86% · Matt Bromiley EP 15 Details
“I think personally, they came in with a phish”
“it makes me want to think it was likely a targeted approach but you never know”
Operation Aurora INVOLVES phishing
The attackers researched targets and sent carefully spoofed phishing emails.
Explicit Confidence 99% · Jack Rhysider EP 19 Details
“Then they would send a phishing e-mail to the target”
Operation Aurora INITIAL_ACCESS_VIA phishing
The described initial access method was a targeted phishing email containing a link.
Explicit Confidence 98% · Jack Rhysider EP 19 Details
“The hackers knew who that person would e-mail normally and what those e-mails would look like so the hacker spoofed an e-mail”
Snow identifies phishing as one of the main types of security assessment she performs.
Explicit Confidence 99% · Snow EP 22 Details
“The main ones that I do are physical security, phishing”
Saudi Aramco cyber-attack (2012) INITIAL_ACCESS_VIA phishing
The attackers likely gained initial access through a phishing e-mail.
Uncertain Confidence 94% · Jack Rhysider EP 30 Details
“The attackers likely got in through a phishing e-mail.”
Apple iCloud phishing campaign INITIAL_ACCESS_VIA phishing
The celebrity-account campaign obtained initial access through phishing emails and cloned login pages.
Explicit Confidence 99% · Jack Rhysider EP 34 Details
“the hacks were done by targeting individual people and then sending phishing e-mails to get into their iCloud logins.”
Carbanak INITIAL_ACCESS_VIA phishing
The campaign initially entered a bank through a phishing email sent to an employee.
Explicit Confidence 99% · Jornt v.d. Wiel EP 35 Details
“They send a spare phishing e-mail to an employee at the bank”
JekHyde and Carl sent a targeted phishing email to the employee they selected as a mark.
Explicit Confidence 99% · JekHyde EP 41 Details
“we put a phish together, a phishing e-mail”
JekHyde and Carl physical penetration engagement INITIAL_ACCESS_VIA phishing
The team obtained initial physical access through a targeted phishing and pretexting campaign that prompted an employee to invite them to the facility.
Derived Confidence 97% · Jack Rhysider EP 41 Details
“they’ve got someone inside inviting them in”
Project Raven USES phishing
Project Raven personnel taught Emiratis how to establish phishing emails as an access method.
Explicit Confidence 98% · Jack Rhysider EP 47 Details
“how to set up a phishing e-mail and use Metasploit to gain access”
India-Pakistan cyber-conflict INVOLVES phishing
The historical cyber-conflict included sophisticated phishing attempts against Pakistani companies and Indian embassies.
Explicit Confidence 98% · Jack Rhysider EP 51 Details
“This included some sophisticated phishing attempts”
John Strand USES phishing
John uses a document-based phishing method to induce a suspect to open a document that beacons back.
Explicit Confidence 96% · Jack Rhysider EP 67 Details
“use social engineering and phishing methods for good”
Social Engineer LLC USES phishing
The company conducts security-awareness and penetration-test phishing campaigns for clients.
Explicit Confidence 98% · Christopher Hadnagy EP 69 Details
“we’re full-board doing SE testing and phishing and all this other work”
“our end goal with that kind of phishing is to teach them how to catch it”
Christopher Hadnagy USES phishing
Chris uses phishing campaigns as part of client security-awareness and penetration testing.
Explicit Confidence 99% · Christopher Hadnagy EP 69 Details
“In this particular test, we started off with a phishing e-mail”
“our goal is to steal credentials, to install an implant”
Electronik Tribulation Army USES phishing
Ghost Exodus says ETA initially practiced phishing.
Explicit Confidence 98% · Jack Rhysider EP 70 Details
“and phishing”
Bangladesh Bank heist INITIAL_ACCESS_VIA phishing
Initial access was obtained through phishing emails containing a purported job applicant's CV.
Explicit Confidence 99% · Geoff White EP 72 Details
“A few employees get the classic phishing e-mail; it’s a zip file that contains a CV”
Olympic Destroyer INITIAL_ACCESS_VIA phishing
The initial infection appears to have begun with phishing emails containing malicious Word documents.
Explicit Confidence 99% · Jack Rhysider EP 77 Details
“the initial infection of the Olympic network began with a phishing e-mail”
phishing USES Malicious Macro Generator
The phishing documents used macros created with the Malicious Macro Generator.
Explicit Confidence 98% · Jack Rhysider EP 77 Details
“these macros were created with a tool called Malicious Macro Generator”
Dark Basin USES phishing
Dark Basin sent phishing links to victims in crafted emails.
Explicit Confidence 99% · Jack Rhysider EP 79 Details
“E-mails were sent to victims with phishing links in them”
BellTroX InfoTech Services USES phishing
BellTroX employees publicly displayed phishing pages and the company was described as offering email hacking and penetration services.
Explicit Confidence 97% · John Scott-Railton EP 79 Details
“Look at these swank-looking phishing pages that I’ve generated.”
Cameron Harrison USES phishing
Cam learned and conducted phishing campaigns to steal account and payment information.
Explicit Confidence 99% · Jack Rhysider EP 85 Details
“He found someone who would teach him how to phish”
Molerats' campaigns are described as sending targeted phishing emails and documents to victims.
Derived Confidence 97% · Assaf Dahan EP 89 Details
“the operators sent a phishing PDF to their victims.”
“specific individuals were sent these phishing e-mails”
Jenny Radcliffe USES phishing
Jenny says that phishing is one of the methods used in her work, while contrasting it with other forms of social engineering.
Explicit Confidence 92% · Jenny Radcliffe EP 90 Details
“We can just phish people or whatever.”
Azrael used a deceptive message and an injected stanza to get a suspected pedophile to click a link, which Jack characterized as a classic phishing scheme.
Explicit Confidence 98% · Jack Rhysider EP 93 Details
“So, a classic phishing scheme”
Jonathan Studebaker USES phishing
Jonathan explicitly lists phishing among his activities.
Explicit Confidence 99% · Jonathan Studebaker EP 95 Details
“the social engineering, phishing, stuff like that.”
Alethe Denis USES phishing
Alethe conducts phishing engagements as part of her social-engineering work.
Explicit Confidence 99% · Alethe Denis EP 107 Details
“to do more vishing, phishing”
TeaMp0isoN USES phishing
TeaMp0isoN used a phishing email as the initial access method in the hotel compromise involving P. Diddy.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“to get into this hotel’s network, it started with a phishing e-mail”
P. Diddy hotel compromise INITIAL_ACCESS_VIA phishing
The hotel compromise began with a phishing email crafted to appear to come from another hotel employee.
Explicit Confidence 99% · Jack Rhysider EP 109 Details
“it started with a phishing e-mail”
Drew says the fake gift-card balance site was a phishing page, and Jack says Drew operated one himself.
Explicit Confidence 99% · Drew EP 112 Details
“It’s a phishing page.”
“He learned how to clone a website which is really easy, and set up his own phishing site”
NiceHash hack INITIAL_ACCESS_VIA phishing
Employees at NiceHash received phishing emails, and an employee apparently clicked one, opened its attachment, and became infected.
Explicit Confidence 99% · Geoff White EP 119 Details
“Employees at NiceHash start to get phishing e-mails sent to them”
Kuwait bank robbery report INVOLVES phishing
The broader bank-robbery campaign described in the episode commonly began with phishing emails sent to banking employees; the episode connects this campaign context to the Kuwait robbery report without establishing that phishing was used in the Kuwait case specifically.
Derived Confidence 72% · Jack Rhysider EP 120 Details
“usually sending phishing e-mails to banking employees”
Newswire hacking and insider-trading scheme INVOLVES phishing
The scheme involved phishing as one of the hacking tactics used against the newswires.
Explicit Confidence 99% · Paul Fishman EP 123 Details
“including brute force attacks, SQL injection attacks, and phishing”
Evaldas Rimasauskas BEC scam INVOLVES phishing
Jack characterizes BEC as a phishing attack in which the attacker poses as someone known to the victim.
Explicit Confidence 99% · Jack Rhysider EP 124 Details
“BEC is basically a phishing attack, but you’re posing as someone that the victim knows already.”
Welcome to Video investigation and takedown INVOLVES phishing
A Welcome to Video user impersonated a moderator and phished other users' credentials to access their videos.
Explicit Confidence 99% · Andy Greenberg EP 131 Details
“He was actually just phishing people, essentially, on Welcome to Video, pretending to be a moderator”
Costa Rica ransomware attack INITIAL_ACCESS_VIA phishing
The Costa Rica campaign infected departments through phishing emails as well as other internet-connected systems.
Explicit Confidence 97% · Omar Avilez EP 135 Details
“They were attacking government organizations through phishing”
The D.R. Incident INITIAL_ACCESS_VIA phishing
The investigation found that the attackers entered the network through a phishing attack.
Explicit Confidence 99% · Omar Avilez EP 135 Details
“the attackers got into the network via a phishing attack”
Citizen Lab describes Predator infections as beginning with a phishing text message.
Explicit Confidence 98% · Jack Rhysider EP 137 Details
“First, the victim would receive a phishing text message”
Business E-mail Compromise ASSOCIATED_WITH phishing
Ronnie describes phishing as the overarching term for e-mail-based threats, while distinguishing it from financially motivated BEC.
Explicit Confidence 96% · Ronnie Tokazowski EP 141 Details
“phishing is kind of the overarching term for any e-mail-based threat like that”
Chris Rock USES phishing
The episode describes Chris sending phishing emails with PDF attachments to compromise bank employees and other targets.
Explicit Confidence 99% · Jack Rhysider EP 151 Details
“he found a bank employee, sent them a phishing e-mail, got them to open a PDF which planted a Trojan on their computer”
Hieu Minh Ngo USES phishing
Hieu used phishing emails to compromise private investigators' computers and impersonate them.
Explicit Confidence 99% · Hieu Minh Ngo EP 162 Details
“I used that to do phishing. I was phishing them to a malware”
The malware was distributed through phishing emails and Craigslist posts.
Explicit Confidence 98% · Jack Rhysider EP 175 Details
“specifically through phishing e-mails and Craigslist posts”