Spearphishing Service (T1598.001) is a sub-technique of Phishing for Information in the reconnaissance tactic. Its platform is PRE. The messages travel through third-party services, not your corporate email.
How attackers use it
MITRE says adversaries send messages through various social media services, personal webmail and other non-enterprise controlled services. These services are more likely to have a less strict security policy than an enterprise.
The goal is usually to build rapport or get the target's interest. MITRE gives an example: adversaries may create fake social media accounts and message employees about job opportunities. That gives a plausible reason to ask about services, policies and information about the employee's environment.
They may also use details from earlier reconnaissance, such as social media or victim-owned websites, to write lures that sound believable.
How to detect it
MITRE says to monitor social media traffic for suspicious activity, including messages requesting information and abnormal file or data transfers, especially involving unknown or suspicious accounts. It also notes that much of this activity occurs outside your visibility, so focus on related stages such as Initial Access.
Practically, your best sensor is the employee. Ask people to report odd approaches on any platform, including personal accounts that mention their work.
How to reduce the risk
MITRE's mitigation is User Training: teach people to identify social engineering techniques and spearphishing attempts.
- Include recruiter-style approaches in your awareness examples.
- State clearly that employees should not discuss internal tools, policies or environments with unknown contacts.
- Give people one place to report approaches.
Quick check
Why are third-party services attractive for this?
They sit outside enterprise controls and are more likely to have weaker security policies than the corporate email environment.
