Internal Spearphishing (T1534) is a Lateral Movement technique. After an adversary already controls an account or a system in your environment, they use it to phish other people in the same organization. MITRE lists Linux, macOS, Office Suite, SaaS and Windows.
How attackers use it
MITRE describes a multi stage campaign. A legitimate account is first compromised, either by controlling the user's device or by getting the account credentials. The adversary then uses that trusted internal identity to raise the odds that colleagues fall for the next phish, often with Impersonation.
The messages may carry a Spearphishing Attachment or Spearphishing Link, delivering a payload or sending people to a site that mimics a login page to capture credentials through Input Capture. MITRE also notes adversaries may use internal chat apps such as Microsoft Teams to spread malicious content or to push users toward giving up sensitive information.
The reason it works is plain: people trust messages from coworkers, and mail filters that focus on external senders may treat internal mail as safe.
How to detect it
MITRE's analytics, by platform:
- A sequence of internal mail from a recently compromised account, preceded by abnormal logon or device activity, with attachments or links that lead to execution or credential harvesting. Look for internal delivery to peers with unusual attachments, then click events, process starts or credential prompts.
- On Linux mail clients, unexpected user activity with mail transfer logs and then attachment download or execution.
- On macOS, odd Apple Mail use with internal relays followed by file execution or scripts launched from Mail.
- In SaaS apps such as Slack, Teams or Gmail, a message from a compromised user with an attachment or link, followed by a click and credential access.
- Outlook or Word forwarding suspicious internal attachments with macro content, auto opening behavior or macro prompts.
Good starting points: a sudden change in a sender's volume or recipient list, a new sign in location right before bulk internal mail, and links in internal messages that point to external domains the organization has never used.
How to reduce the risk
MITRE lists no mitigations for this technique. Practical steps follow from the detections:
- Apply the same mail and link scanning to internal messages as to external ones.
- Protect accounts with phishing resistant multi-factor authentication so the first compromise is harder.
- Give staff an easy way to report a suspicious message, including ones that appear to come from a coworker.
- Be able to remove a message from every mailbox quickly once you spot it.
Quick check
Why is internal spearphishing effective?
It comes from a trusted, legitimate internal account, so recipients are less suspicious, and filters may be tuned mainly for external senders.
