T1566.001: Spearphishing Attachment

Initial Access Intelligence Profile

AI Answer

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social (Source: MITRE ATT&CK T1566.001)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

Field	Value
Technique ID	T1566.001
Name	Spearphishing Attachment
Tactic	Initial Access (initial-access)
Platforms	Linux, macOS, Windows
Sub-technique	Yes

Why it matters

In the OpenTrojan knowledge graph, Spearphishing Attachment (T1566.001) is one of the highest-connectivity ATT&CK techniques: 149 MITRE STIX relationships reference this technique; 78 threat groups observed using it; 61 software families associated; 10 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1566.001). Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary’s payload exploits a vulnerability or directly executes on the user’s system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.

Detection

Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.

Mitigation

Use intrusion detection signatures to block traffic at network boundaries.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

TrickBot
BLINDINGCAN
Bumblebee
KOPILUWAK
ThreatNeedle
Pony
OceanSalt
AppleSeed
NETWIRE
EnvyScout
Emotet
Woody RAT

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

APT38
Elderwood
SideCopy
Kimsuky
EXOTIC LILY
admin@338
Patchwork
APT41
Dragonfly
Gorgon Group
menuPass
APT32

Group associations are from MITRE ATT&CK STIX relationships.

Operation Dream Job
Frankenstein
RedDelta Modified PlugX Infection Chain Operations
Operation Dust Storm
2015 Ukraine Electric Power Attack
Operation Spalax
Water Curupira Pikabot Distribution
C0015
Operation AkaiRyū
C0011

Campaign associations are from MITRE ATT&CK STIX relationships.

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Start Investigation

Move from reading to investigating T1566.001 Spearphishing Attachment. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about T1566.001 Spearphishing Attachment?
Evidence — assertions mapped to verifiable references.
Timeline — events in chronological order.
Related Entities — CVE, threat actor, campaign, malware links.
Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace