T1566.002: Phishing: Spearphishing Link (Social engineering to force the user to download the tool)
Operational Executive Summary
T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool)) is classified under the Initial Access tactic within the MITRE ATT&CK framework. Techniques used by adversaries to gain their initial foothold within an enterprise network, spanning spearphishing, drive-by downloads, exploit kits, and compromised edge perimeter appliances. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 98 distinct malware families, totaling over 38,894 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Phishing: Spearphishing Link (Social engineering to force the user to download the tool) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Phishing: Spearphishing Link (Social engineering to force the user to download the tool), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1566.002 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Phishing: Spearphishing Link (Social engineering to force the user to download the tool) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1566/002/.
Detection Engineering & Threat Hunting
Detecting Phishing: Spearphishing Link (Social engineering to force the user to download the tool) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Phishing: Spearphishing Link (Social engineering to force the user to download the tool) across adjacent network segments.
Cataloged Malware Families Utilizing T1566.002 (98 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1566.002 (Phishing: Spearphishing Link (Social engineering to force the user to download the tool)):
98 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| ramnit | Worm Banker | 20,595 | Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010. Originally conceived as a Windows fil... |
| zusy | Banking Trojan | 14,120 | Tinba (formally designated in AV classification as Zusy or IlliBanker, and colloquially celebrated as the 'Tiny Banker') is a notoriously compact banking trojan... |
| darkgate | Loader | 1,205 | DarkGate is an evasive, commercial Malware-as-a-Service (MaaS) loader and remote access platform developed by a cybercriminal known as 'RastaFarEye'. Active pri... |
| appster | Adware | 637 | Appster (recognized across cybersecurity solutions as Adware:Win32/Appster, PUA:Win32/Appster, and Adware.Appster) is an aggressive software bundler, monetizati... |
| loadmoney | Adware | 398 | LoadMoney (cataloged across cybersecurity vendors as Adware:Win32/LoadMoney, PUA:Win32/LoadMoney, and PUP.Optional.LoadMoney) is a Russian-origin pay-per-instal... |
| lolbot | Worm | 374 | Worm:Win32/Lolbot is a notorious worm and remote access trojan that achieved massive global distribution by hijacking instant messaging platforms—including Skyp... |
| koobface | Worm | 350 | Koobface (an anagram of 'Facebook') was the definitive pioneer of social-network worm and botnet operations, reigning as one of the most prolific and profitable... |
| driverpack | Pua | 326 | DriverPack (DriverPack Solution, recognized across endpoint security engines as PUA:Win32/DriverPack, Adware:Win32/DriverPack, and PUP.Optional.DriverPackSoluti... |
| blackmoon | Banking Trojan | 228 | Trojan:Win32/Blackmoon (widely designated in cybersecurity research as KRBanker) is a destructive, regionally focused banking trojan that emerged in 2014, speci... |
| rodecap | Trojan | 165 | Rodecap (cataloged by security vendors as Trojan:Win32/Rodecap.A, Trojan.Win32.Rodecap, TrojanDownloader:Win32/Rodecap, and Adware:Win64/Redcap) is an infamous ... |
| palevo | Botnet | 106 | Worm:Win32/Palevo (universally known in cybersecurity research as the Butterfly Bot and the Mariposa botnet) was a monumental, highly modular crimeware botnet t... |
| netsky | Worm | 105 | Worm:Win32/Netsky is a historically monumental, prolific mass-mailing computer worm that emerged in February 2004, causing tens of millions of dollars in global... |
| skypespam | Worm | 95 | SkypeSpam (cataloged across antivirus vendors under signatures including Worm:Win32/SkypeSpam, Trojan:Win32/SkypeSpam, Worm:Win32/Pykspa, and Trojan.SkypeSpam) ... |
| kelihos | Spam Bot | 47 | Worm:Win32/Kelihos (also known as Hlux) was a massive, highly resilient peer-to-peer (P2P) botnet that operated from 2010 until its final federal dismantling in... |
| casbaneiro | Trojan | 10 | Casbaneiro (classified in antivirus detection telemetry under designations including Trojan:Win32/Casbaneiro, Trojan.Win32.Casbaneiro, and Win32/Casbaneiro) is ... |
| mypcbackup | Advanced Threat | 9 | PUA:Win32/Mypcbackup is a notorious Potentially Unwanted Program (PUA) that operates as highly aggressive 'Scareware'. It masquerades as a legitimate, essential... |
| pckeeper | Advanced Threat | 9 | Rogue:Win32/Pckeeper (also marketed under various names) is a classic example of 'Scareware' and a Rogue PC Optimizer. It is a Potentially Unwanted Program (PUA... |
| regcure | Advanced Threat | 9 | Rogue:Win32/Regcure is one of the most infamous and widely distributed examples of a 'Rogue Registry Cleaner' or Scareware. It is a Potentially Unwanted Program... |
| speedchecker | Advanced Threat | 9 | PUA:Win32/Speedchecker is a Potentially Unwanted Program (PUA) and adware family that masquerades as a 'PC Optimization' or 'Internet Speed Test' utility. Much ... |
| tsklnk | Trojan | 4 | Trojan:Win32/Tsklnk (Task Link) is a specific classification for malware that abuses legitimate Windows Shortcut files (`.lnk`) and the Windows Task Scheduler t... |
| hostmodifier | Advanced Threat | 3 | Behavior:Win32/Hostmodifier is a specific **Heuristic Detection** that flags unauthorized modification of the Windows `hosts` file (`C:\Windows\System32\drivers... |
| ammyy | Ransomware | 2 | Ammyy (classified in antivirus detection telemetry under designations including Ransom:Win32/Ammyy, Ransom.Win32.Ammyy, and Win32/Ammyy) is a crypto-ransomware ... |
| autorunerent | Trojan | 2 | Autorunerent (classified in antivirus detection telemetry under designations including Trojan:Win32/Autorunerent, Trojan.Win32.Autorunerent, and Win32/Autoruner... |
| bundleloader | Trojan Downloader | 2 | Bundleloader (classified in antivirus detection telemetry under designations including TrojanDownloader:Win32/Bundleloader, TrojanDownloader.Win32.Bundleloader,... |
| carambisdu | Trojan | 2 | Carambisdu (classified in antivirus detection telemetry under designations including Trojan:Win32/Carambisdu, Trojan.Win32.Carambisdu, and Win32/Carambisdu) is ... |
| fakesupport | Ransomware | 2 | Adware/Trojan:Win32/Fakesupport is a classification encompassing malware and aggressive adware specifically designed to facilitate Technical Support Scams. Unli... |
| fakesysdef | Advanced Threat | 2 | Rogue:Win32/Fakesysdef is a classic and aggressive example of Rogue Software, specifically categorized as 'Scareware' or a Fake HDD Defragmenter/Repair tool. It... |
| lineage | Advanced Threat | 2 | PWS:Win32/Lineage (Password Stealer) is a highly targeted classification for malware designed specifically to steal credentials, account information, and valuab... |
| pcmechanic | Advanced Threat | 2 | Rogue:Win32/Pcmechanic is a classic example of Rogue Software, specifically a 'Fake System Optimizer' or 'Scareware'. It masquerades as a legitimate PC performa... |
| pcoptimizerpro | Advanced Threat | 2 | Rogue:Win32/Pcoptimizerpro is a classic example of 'Rogue Software', 'Scareware', or a 'Fake System Optimizer'. It masquerades as a legitimate PC performance en... |
| qqrob | Trojan | 2 | Trojan:Win32/Qqrob is a highly specific Information Stealer designed to target users of the Tencent QQ instant messaging platform, which is massively popular in... |
| rustock | Advanced Threat | 2 | Rootkit:Win32/Rustock (internally designated as Costrat) was an extraordinarily sophisticated, stealthy kernel-mode rootkit and spam botnet active between 2006 ... |
| speed | Advanced Threat | 2 | Rogue:Win32/Speed is a classic example of Rogue Software, specifically a 'Fake System Optimizer' or 'Scareware'. It masquerades as a legitimate PC performance e... |
| vprotect | Advanced Threat | 2 | Rogue:Win32/Vprotect is a prominent example of 'Rogue Security Software', 'Fake AV', or 'Scareware'. It is designed to look and act like a legitimate antivirus ... |
| 2345cn | Trojan | 1 | 2345Cn (classified in antivirus detection telemetry under designations including Trojan:Win32/2345Cn, Trojan.Win32.2345Cn, and Win32/2345Cn) is a multi-stage tr... |
| 2345explorer | Trojan | 1 | 2345Explorer (classified in antivirus detection telemetry under designations including Trojan:Win32/2345Explorer, Trojan.Win32.2345Explorer, and Win32/2345Explo... |
| adagent | Ransomware | 1 | Adagent (classified in antivirus detection telemetry under designations including Ransom:Win32/Adagent, Ransom.Win32.Adagent, and Win32/Adagent) is a crypto-ran... |
| anserin | Ransomware | 1 | Anserin (classified in antivirus detection telemetry under designations including Ransom:Win32/Anserin, Ransom.Win32.Anserin, and Win32/Anserin) is a crypto-ran... |
| anyprotect | Trojan | 1 | Anyprotect (classified in antivirus detection telemetry under designations including Trojan:Win32/Anyprotect, Trojan.Win32.Anyprotect, and Win32/Anyprotect) is ... |
| apropos | Trojan | 1 | Apropos (classified in antivirus detection telemetry under designations including Trojan:Win32/Apropos, Trojan.Win32.Apropos, and Win32/Apropos) is a multi-stag... |
| bamital | Ransomware | 1 | Bamital (classified in antivirus detection telemetry under designations including Ransom:Win32/Bamital, Ransom.Win32.Bamital, and Win32/Bamital) is a crypto-ran... |
| bankfraud | Trojan | 1 | Bankfraud (classified in antivirus detection telemetry under designations including Trojan:Win32/Bankfraud, Trojan.Win32.Bankfraud, and Win32/Bankfraud) is a mu... |
| bmmedia | Ransomware | 1 | Bmmedia (classified in antivirus detection telemetry under designations including Ransom:Win32/Bmmedia, Ransom.Win32.Bmmedia, and Win32/Bmmedia) is a crypto-ran... |
| bomka | Ransomware | 1 | Bomka (classified in antivirus detection telemetry under designations including Ransom:Win32/Bomka, Ransom.Win32.Bomka, and Win32/Bomka) is a crypto-ransomware ... |
| brosafe | Trojan | 1 | Brosafe (classified in antivirus detection telemetry under designations including Trojan:Win32/Brosafe, Trojan.Win32.Brosafe, and Win32/Brosafe) is a multi-stag... |
| browsecx | Trojan | 1 | Browsecx (classified in antivirus detection telemetry under designations including Trojan:Win32/Browsecx, Trojan.Win32.Browsecx, and Win32/Browsecx) is a multi-... |
| bubbledock | Trojan | 1 | Bubbledock (classified in antivirus detection telemetry under designations including Trojan:Win32/Bubbledock, Trojan.Win32.Bubbledock, and Win32/Bubbledock) is ... |
| cdnhelper | Ransomware | 1 | Cdnhelper (classified in antivirus detection telemetry under designations including Ransom:Win32/Cdnhelper, Ransom.Win32.Cdnhelper, and Win32/Cdnhelper) is a cr... |
| chinad | Ransomware | 1 | <h3>Executive Summary</h3> ChinaAd (also referred to as Chinad) is a prevalent family of Adware, Spyware, and Potentially Unwanted Programs (PUPs) originating f... |
| cntads | Advanced Threat | 1 | <h3>Executive Summary</h3> Cntads is a highly persistent adware family and Potentially Unwanted Program (PUP) engineered to hijack web traffic and bombard users... |
| deepsea | Advanced Threat | 1 | <h3>Executive Summary</h3> DeepSea is an intrusive adware family and Potentially Unwanted Program (PUP) that aggressively alters browser behavior and injects un... |
| easyspeedcheck | Advanced Threat | 1 | <h3>Executive Summary</h3> EasySpeedCheck is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware that masquerades as a critical sys... |
| edeals | Advanced Threat | 1 | <h3>Executive Summary</h3> EDeals (often detected as Adware.EDeals or PUP.EDeals) is a prevalent family of aggressive Adware and Potentially Unwanted Programs (... |
| esaprof | Ransomware | 1 | <h3>Executive Summary</h3> Esaprof is a prevalent family of Adware and Potentially Unwanted Programs (PUPs) engineered to aggressively monetize an infected user... |
| fakehack | Advanced Threat | 1 | Program:Win32/Fakehack (or similar Rogue Security Software) is a type of Scareware or Potentially Unwanted Program (PUP) that uses social engineering to extort ... |
| feedarch | Ransomware | 1 | <h3>Executive Summary</h3> Feedarch is a prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user's ... |
| fenomengame | Trojan | 1 | <h3>Executive Summary</h3> FenomenGame is a family of Adware and Potentially Unwanted Programs (PUPs) engineered to aggressively monetize an infected user's web... |
| flvdownloader | Advanced Threat | 1 | Adware:Win32/Flvdownloader (or PUA:Win32/Flvdownloader) is a classification for Potentially Unwanted Programs (PUPs) and adware that disguise themselves as legi... |
| funmood | Advanced Threat | 1 | <h3>Executive Summary</h3> Funmood (often seen as Funmoods Toolbar) is a highly prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Browser ... |
| gameapp | Advanced Threat | 1 | <h3>Executive Summary</h3> GameApp is a Potentially Unwanted Program (PUP) that straddles the line between adware and deceptive grayware. Often marketed as a fr... |
| gameol | Advanced Threat | 1 | <h3>Executive Summary</h3> Gameol is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware that primarily targets casual gamers. Masq... |
| gamium | Advanced Threat | 1 | <h3>Executive Summary</h3> Gamium is a Potentially Unwanted Program (PUP) and adware variant that specifically targets the monetization of the user's web browsi... |
| gamsofts | Advanced Threat | 1 | Adware:Win32/Gamsofts (or PUA:Win32/Gamsofts) is a classification for Potentially Unwanted Programs (PUPs) and adware that disguise themselves as legitimate uti... |
| gaofenquming | Advanced Threat | 1 | <h3>Executive Summary</h3> Gaofenquming is an intrusive adware family and browser hijacker predominantly targeting users in the Asia-Pacific (APAC) region. It i... |
| getnow | Ransomware | 1 | <h3>Executive Summary</h3> Getnow is a prevalent family of Adware and Potentially Unwanted Programs (PUPs), frequently operating as a deceptive downloader or "d... |
| globalacces | Advanced Threat | 1 | <h3>Executive Summary</h3> GlobalAcces (often detected as Adware.GlobalAccess or PUP.GlobalAcces) is a pervasive family of Adware and Potentially Unwanted Progr... |
| glukelira | Ransomware | 1 | <h3>Executive Summary</h3> Glukelira is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user's... |
| goobzo | Trojan | 1 | <h3>Executive Summary</h3> Goobzo is a widespread family of Adware and Browser Hijackers engineered to aggressively monetize an infected user's web browsing act... |
| innomod | Ransomware | 1 | <h3>Executive Summary</h3> Innomod is a prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user's w... |
| istartsurfinstaller | Advanced Threat | 1 | <h3>Executive Summary</h3> iStartSurfInstaller (and its associated payload, iStartSurf) is a prevalent family of Adware and Browser Hijackers engineered to aggr... |
| istbar | Advanced Threat | 1 | <h3>Executive Summary</h3> ISTbar is a classic, highly aggressive family of Adware and Browser Hijackers that gained immense notoriety in the early 2000s, prima... |
| iwin | Advanced Threat | 1 | <h3>Executive Summary</h3> iWin (often detected as Adware.iWin or PUP.iWin) is a widespread family of Adware and Potentially Unwanted Programs (PUPs). It is his... |
| kelvir | Trojan | 1 | <h3>Executive Summary</h3> Kelvir is a widespread and aggressive family of Worms that primarily propagate by exploiting instant messaging networks, most notably... |
| micronames | Trojan | 1 | <h3>Executive Summary</h3> Micronames (often detected as Adware.Micronames or Trojan.Micronames) is a prevalent family of aggressive Adware and Potentially Unwa... |
| opriupdater | Advanced Threat | 1 | <h3>Executive Summary</h3> Opriupdater is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware that primarily targets casual users b... |
| paper | Ransomware | 1 | <h3>Executive Summary</h3> The "Paper" malware family is typically categorized as adware, a Potentially Unwanted Program (PUP), or a browser hijacker. It is eng... |
| playgames | Advanced Threat | 1 | <h3>Executive Summary</h3> PlayGames is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware that primarily targets casual gamers. M... |
| plicker | Advanced Threat | 1 | <h3>Executive Summary</h3> Plicker is an intrusive adware family and Potentially Unwanted Program (PUP) designed to aggressively monetize infected systems. It h... |
| podnuha | Advanced Threat | 1 | <h3>Executive Summary</h3> Podnuha (derived from the Russian word for "slip" or "trick") is a pervasive family of Adware and Potentially Unwanted Programs (PUPs... |
| popad | Trojan | 1 | <h3>Executive Summary</h3> Popad is a pervasive family of Adware engineered to aggressively monetize an infected user's web browsing activity. True to its name,... |
| prast | Advanced Threat | 1 | <h3>Executive Summary</h3> Prast is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware. Masquerading as a convenient system utilit... |
| sbyinying | Ransomware | 1 | <h3>Executive Summary</h3> Sbyinying is a highly persistent adware and Potentially Unwanted Program (PUP) designed to monetize infected systems through aggressi... |
| searchbar | Advanced Threat | 1 | <h3>Executive Summary</h3> SearchBar is a prominent family of Browser Hijackers and Adware engineered to aggressively monetize an infected user's web browsing a... |
| searchsetter | Advanced Threat | 1 | <h3>Executive Summary</h3> SearchSetter is a prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Browser Hijackers engineered to rapidly mon... |
| sennaonemaker | Ransomware | 1 | <h3>Executive Summary</h3> SennaOneMaker is a prolific adware family and Potentially Unwanted Program (PUP) notorious for bombarding infected systems with intru... |
| shopperz | Advanced Threat | 1 | <h3>Executive Summary</h3> Shopperz is a widespread family of Adware and Browser Hijackers designed to aggressively monetize an infected user's web browsing act... |
| soulclose | Ransomware | 1 | <h3>Executive Summary</h3> Soulclose is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user's... |
| storm | Botnet | 1 | Worm:Win32/Storm (universally documented in cybersecurity literature as the Storm Worm, Peed, and Nuwar) was a revolutionary peer-to-peer (P2P) botnet that infe... |
| syncopate | Advanced Threat | 1 | <h3>Executive Summary</h3> Syncopate is a pervasive family of Potentially Unwanted Programs (PUPs) and aggressive Adware. Masquerading as a convenient system ut... |
| talalpek | Ransomware | 1 | <h3>Executive Summary</h3> Talalpek is a prevalent family of Adware and Potentially Unwanted Programs (PUPs) engineered to aggressively monetize an infected use... |
| tibsystems | Ransomware | 1 | <h3>Executive Summary</h3> TIBSYSTEMS is a prevalent family of Potentially Unwanted Programs (PUPs) and aggressive Adware designed to monetize an infected user'... |
| tongji | Ransomware | 1 | <h3>Executive Summary</h3> Tongji is a family of Adware, Spyware, and Potentially Unwanted Programs (PUPs), frequently originating from Chinese software markets... |
| unigo | Advanced Threat | 1 | <h3>Executive Summary</h3> Unigo (often detected as Adware.Unigo or PUP.Unigo) is a prevalent family of aggressive Adware and Potentially Unwanted Programs (PUP... |
| whenu | Advanced Threat | 1 | <h3>Executive Summary</h3> WhenU (most famous for its "SaveNow" application) is one of the original, pioneering families of Adware. Highly prevalent in the earl... |
| whimoo | Ransomware | 1 | <h3>Executive Summary</h3> Whimoo is a prevalent adware family and Potentially Unwanted Program (PUP) designed to aggressively monetize an infected user's web b... |
| wrar | Trojan | 1 | <h3>Executive Summary</h3> "Wrar" (often flagged as Riskware.Wrar or PUP.Wrar) is a detection classification that typically refers to cracked, modified, or bund... |
| youtubedownloaderguru | Trojan | 1 | <h3>Executive Summary</h3> YoutubeDownloaderGuru is a prevalent Potentially Unwanted Program (PUP) and Adware family that masquerades as a legitimate, highly so... |
| zenosearch | Advanced Threat | 1 | <h3>Executive Summary</h3> ZenoSearch is a prominent family of Browser Hijackers and Adware engineered to aggressively monetize an infected user's web browsing ... |