Article
How Spear Phishing Campaigns Target C-Suite Executives: Tactics, Tools, and Defense
Learn how spear phishing and whaling campaigns target C-suite executives with AI, OSINT, deepfakes and BEC tactics, and how to defend against them.
Read more
Attack technique
Phishing (T1566): ATT&CK Technique
Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.
In short
Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. It is a common first step into a network. Defenders check attachments and links before delivery, use multi-factor authentication and make it easy for staff to report suspicious messages.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Stealth
- Defense Impairment
- Credential Access
- Discovery
- Lateral Movement
- Collection
- Command and Control
- Exfiltration
- Impact
Initial Access · Step 3 Of 15 In The Attack Chain
- MITRE IDT1566ATT&CK technique
- Detection3ways to spot itData sources MITRE lists
- Defences2ways to stop it
How it works
The attacker sends a message that looks trustworthy. It carries a malicious attachment or a link to a fake login page. If the person opens the file or types their password, the attacker gets a first foothold. MITRE lists four sub-techniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service and T1566.004 Spearphishing Voice.
A real example
- MITRE ATT&CK lists Kimsuky as using spearphishing to gain initial access and intelligence.
- MITRE ATT&CK lists MuddyWater as sending phishing emails to targets from a support-style email address.
- MITRE ATT&CK lists Royal as spread through phishing campaigns, including callback phishing where victims are lured into calling a phone number given in an email.
- MITRE ATT&CK lists INC Ransom as using phishing to gain initial access.
- MITRE ATT&CK lists Axiom as using spear phishing to compromise victims at the start of an intrusion.
Who uses it
- Threat group APT28 The US, UK, EU and other governments attribute APT28 to Russia's military intelligence service, the GRU, specifically its 85th Main Special Service Center (military unit 26165). Russia · Since 2004
- Threat group APT29 The US, UK and other governments have attributed APT29 to Russia's Foreign Intelligence Service (SVR). Russia · Since 2008
- Ransomware group BianLian BianLian is a ransomware and data extortion group that the FBI, CISA and Australia's ACSC say is likely based in Russia. Active · Since 2022 · Developer and deployer group with Russia-based affiliates
- Ransomware group Black Basta ransomware group Black Basta is a ransomware as a service operation, first identified in April 2022. Since 2022 · Ransomware as a service
- Ransomware group Cl0p Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505. Active · Since 2019 · Ransomware as a service, and data theft campaigns (per the advisory)
- Ransomware group Conti ransomware group Conti was a ransomware as a service operation first observed in December 2019, per MITRE ATT&CK. Inactive · Since 2019 · Ransomware as a service, with a wage model per CISA
- Ransomware group DarkSide DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S. Inactive · Since 2020 · Ransomware as a service
- Ransomware group Hive Hive was a ransomware as a service operation active from June 2021. Disrupted · Since 2021 · Ransomware as a service
- Threat group Lazarus Group Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units that, they say, work for the Reconnaissance General Bureau. North Korea · Since 2009
- Ransomware group LockBit LockBit is a ransomware as a service operation first seen in January 2020. Disrupted · Since 2020 · Ransomware as a service
- Ransomware group Medusa Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Active · Since 2021 · Ransomware as a service (closed group until at least early 2023)
- Ransomware group Qilin Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Active · Since 2022 · Ransomware as a service
- Ransomware group RansomHub RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service
- Ransomware group REvil ransomware group REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019. Disrupted · Since 2019 · Ransomware as a service
Seen in incidents
- Incident APT28 attacks on French entities and French attribution, 2025 On 29 April 2025 France's foreign ministry formally said that Russia's military intelligence service (GRU) used the APT28 attack group to target or compromise a dozen French entities since 2021. 2021 to 2024 · Government and public sector
- Incident Attack and data leak claims about the e-Devlet gateway In February 2023 and June 2026, claims that the e-Devlet gateway had been attacked or its user data leaked were rejected in official statements. February 2023 and June 2026 · Government and public sector
- Incident DMM Bitcoin crypto theft, 2024 In May 2024 about 4,502.9 BTC, worth about 48.2 billion yen, left the wallets of the Japanese crypto exchange DMM Bitcoin without authorization. May 2024 · Financial services
- Incident Ghostwriter (UNC1151) campaigns against Poland, 2024 to 2026 Ghostwriter, which CERT Polska tracks as UNC1151, has run phishing, malware and disinformation campaigns against people and bodies in Poland since at least mid 2021. 2021 to June 2026 · Government and public sector
- Incident HSE Conti ransomware attack In May 2021 Conti ransomware hit Ireland's Health Service Executive (HSE), the public health service. May 2021 · Healthcare
- Incident KHNP nuclear operator hack and data leak, 2014 In December 2014 data from Korea Hydro & Nuclear Power Co. December 2014 · Energy and utilities
- Incident MirrorFace campaigns against Japan, 2019 to 2025 On 8 January 2025 Japan's National Police Agency (NPA) and the National center of Incident readiness and Strategy for Cybersecurity (NISC) said that cyberattack campaigns against Japanese organizations since about 2019 were run by an actor called MirrorFace. 2019 to 2025 · Government and public sector
- Incident MuddyWater campaign against Turkish government entities The US Treasury said in September 2022 that MuddyWater, a subordinate element of Iran's Ministry of Intelligence and Security, was assessed to have been involved, as recently as November 2021, in a campaign targeting Turkish government entities with malware-laden documents likely sent by spear-phishing email. November 2021 · Government and public sector
- Incident Operation reWired business email compromise sweep, Nigeria and international arrests, 2019 Operation reWired was a four-month sweep against business email compromise (BEC) schemes, announced by the US Department of Justice and the FBI on 10 September 2019. May to September 2019 · Financial services
- Incident Zimbra webmail exploitation by Russian state actors On 23 July 2026 the US CISA, NSA, FBI and partner agencies warned that Russian state-supported actors, tracked mainly as LAUNDRY BEAR, were breaking into Zimbra Collaboration Suite webmail. July 2025 to July 2026 · Government and public sector
How to detect
-
Check attachments and links before delivery
Mail filtering that opens files in a sandbox and checks links catches many lures.
-
Watch for new logins after a reported lure
A login from an unusual place soon after a lure can mean the password was taken.
-
Data sources MITRE lists
Application Log Content, File Creation, Logon Session Creation, Process Creation
How to defend
-
Use multi-factor authentication
A stolen password alone no longer opens the account.
-
Make it easy to report a message
People who report a suspicious message early give the team time to act.
Questions
What is phishing in MITRE ATT&CK?
Phishing is technique T1566 in the Initial Access tactic. An attacker sends a message that looks trustworthy and carries a malicious attachment or a link to a fake login page, hoping to gain a first foothold.
How does a phishing attack work?
The message looks trustworthy. If the person opens the attached file or types their password into the fake login page, the attacker gets a first foothold in the network.
How can I detect phishing?
Mail filtering that opens files in a sandbox and checks links catches many lures. A login from an unusual place soon after a lure can also mean the password was taken.
How do I defend against phishing?
Use multi-factor authentication so a stolen password alone no longer opens the account. Make it easy to report a suspicious message, because early reports give the team time to act.
In our research
- How Spear Phishing Campaigns Target C-Suite Executives: Tactics, Tools, and Defense July 2026
- Compromising Email Accounts with Credential Phishing May 2026
- A Phishing Campaign Targeting Hotels and Travel Companies Detected August 2022
- Detecting Phishing Emails August 2022
- A New AiTM Phishing Campaign Targeting Institution/Organization Personnel Has Been Detected August 2022
- Phishing Campaign for Turkish Energy Sector June 2022
Sources
- MITRE ATT&CK T1566 MITRE
- #StopRansomware Guide CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.