Gather Victim Identity Information: Email Addresses

Other sub-techniques of Gather Victim Identity Information (3)

ID	Name
T1589.001	Credentials
T1589.002	Email Addresses
T1589.003	Employee Names

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.

Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).^[1]^[2] Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Email Accounts), and/or initial access (ex: Phishing).

Law Assessment

Article	Assessment
None assessed	There could be an assessment of a subtechnique.

Forensics

Forensic Domain	Assessment
None assessed	There could be a forensic assessment of a subtechnique.

ID: T1589.002

Sub-technique of: T1589

ⓘ

Tactic: Reconnaissance

ⓘ

Platforms: PRE

Version: 1.0

Created: 02 October 2020

Last Modified: 15 April 2021

Schweizerisches Strafgesetzbuch (StGB)

Relevant Articles:

Relevant Forensic Domains:

Provided by LAYER 8

Procedure Examples

ID	Name	Description
G0050	APT32	APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.^[3]
G0125	HAFNIUM	HAFNIUM has collected e-mail addresses for users they intended to target.^[4]
G0094	Kimsuky	Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.^[5]
G0059	Magic Hound	Magic Hound has acquired the personal email addresses of some individuals they intend to target.^[6]
G0069	MuddyWater	MuddyWater has specifically targeted government agency employees with spearphishing e-mails.^[7]
G0034	Sandworm Team	Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.^[8]
G0122	Silent Librarian	Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.^[9]
G0127	TA551	TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.^[10]

Mitigations

ID	Mitigation	Description
M1056	Pre-compromise	This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.

Detection

Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.