Hijacked Email Accounts: Defending Against T1586.002

Compromise Accounts: Email Accounts (T1586.002) is a resource development technique tagged PRE. The adversary takes over existing email accounts to support phishing and other operations.

How attackers use it

MITRE says compromised accounts support phishing for information, phishing and large-scale spam. A trusted persona raises the chance that the victim reads and acts. Compromised email accounts may also help acquire infrastructure, such as domains.

The ways in include phishing for credentials, buying credentials from third-party sites, brute forcing through password reuse from breach dumps, and paying employees, suppliers or business partners for access. Adversaries may target well-known email accounts or domains so that spam or phishing evades reputation-based email filtering. They can also use the account to hijack existing email threads with targets.

How to detect it

MITRE says much of the activity is outside the visibility of the target organization, and it suggests focusing on related stages such as initial access through phishing.

Mail signals, as general practice: replies in old threads that contain unexpected links or attachments, changes to payment details in the middle of a thread, sign-in alerts from new locations and mailbox rules that hide or forward messages.

How to reduce the risk

MITRE's mitigation entry is Pre-compromise. General practice for your own mail:

• Require multi-factor authentication and block legacy protocols that cannot use it.
• Do not reuse passwords, and check for exposed credentials.
• Confirm payment changes and access requests by phone using a number you already hold.
• Audit mailbox forwarding rules regularly.

If you learn that a contact's mailbox was taken over, tell your staff quickly and ask them to hold any pending requests from that sender until verified by phone.

Quick check

Sources

• MITRE ATT&CK T1586.002: Email Accounts