T1566.002 Spearphishing Link in real malware
ATT&CK technique T1566.002 Spearphishing Link appears in 40998 publicly analyzed samples on MalwareAnalyzer by Cyble, 40.6% of the analyzed corpus. Seven-day prevalence is falling (10033 recent vs 29511 prior). Most associated families: SBadur, REvil, Emotet.
Tactics: initial-access
Prevalence in the corpus
- Samples exhibiting T1566.002: 40998
- Share of analyzed corpus: 40.6%
- Last 7 days: 10033 · prior 7 days: 29511 (falling)
Malware families using T1566.002
Example samples
- fbadaf39f985c8799a3606f2aa33099b05d3375643a5629d56fba17fdac8b0af - malicious
- 4ed13c70fc509473b5ea4e56e38e7e55e577c7939a40947531b2a81dc5e462e2 - malicious
- d4d1ffb7b421b03bc60973a62ce5e4f67e5f71b48703ec6788bf1eebfc016de6 - malicious
- 81979980f9cb60d75f4e5b8c248d2efff005e75c69ed94f8b59050b4ba5d8a24 - malicious
- ea95e0523607e61c760d5f7c453d803d094f6b3ee69c180c951e8f7e0b51ba7a - malicious
- bc093a771db4eec93cf8dc93bc36b2def20b3b1c07c6ce0422325d51da5d1153 - malicious
- 6930fdc91be13cdc61ff5f9f625d57cd7965f812d062e8977c38b7e745aa5b82 - malicious
- 90f93dde9a4eff53be507d6d94c552a935a517429c38ba29150dd33689b4a410 - malicious
- 9712e2221395811633c9a8c8613fe53ddd37610791f817cff5dce7c55de9434e - malicious
- 52256d6662dd9d3a025ec6021d9def51d03f495f904631d8ee3342d225d5bca5 - malicious
- a60e4e155d9e30029ead2acda30d37706aafc98f73ececa428a68c2a5f74cbf0 - malicious
- e7e68b717909f57f015162de014f2cfe0b62f2c70ad73ad6b037c28de38abe61 - malicious
- 92623626669a6c5af0a3e40c1e36bf396ecada432fea771b2137b867de123573 - malicious
- 43acd49dcede815dc8178980bbff72f7f38aa7e879705d5bf283c73362651708 - malicious
- 3a0bc66944f31d2ac64c47f465c913791f92cd3255fdbad7f034408c4e021526 - malicious
- b552672b9f5740e485ce680b1ea0a2e11b70bf627038553b558d4c30022c40c5 - malicious
- 14c652aef4ac6471cca65d2eba58ab2f4dd2753d2c9afa7a2173de2c76dbffc3 - malicious
- b0d1534819ef1b5cef3ceeb04ba65d549ed265e1e1e9a4aed724fb920dbc0f7d - malicious
- 45464607e404c36ecb0411f7267cfa9640bde62a9094af20ca522f8e3d539d37 - malicious
- fd7a3d591d79b8b66111799638e04a46c3d72f40f1807f37bd8a1b324a56291c - malicious
- c2bfc618038f7268af5fb9ff8f6930cd6b0254a01011c0ad1d5b97bf23616f4c - malicious
- 8c661c0ae228ef565dd5b4304922904dcc19c94f6c2d5d695caaa4458f37156a - malicious
- 6573d6afe9841003d67cbdd01b39e39dec9ad091c259361e49c754b9f287724e - malicious
- 41a0a67a45dcef76bc674f555143f2d4d564b85fbac2a1df1b243b4b97e9e797 - malicious
- c67e583678927e450a40198b3f43adfe171067a07a9ddd6ca6eef4551bda5b2d - malicious
Canonical technique definition: MITRE ATT&CK T1566.002 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1566.002
- How common is ATT&CK T1566.002 (Spearphishing Link) in real malware?
- ATT&CK technique T1566.002 Spearphishing Link appears in 40998 publicly analyzed samples on MalwareAnalyzer by Cyble, 40.6% of the analyzed corpus. Seven-day prevalence is falling (10033 recent vs 29511 prior). Most associated families: SBadur, REvil, Emotet.
- Is T1566.002 becoming more common?
- Prevalence is falling: 10033 samples in the last seven days against 29511 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1566.002?
- In this corpus T1566.002 is most associated with SBadur (48), REvil (18), Emotet (10). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1566.002?
- 40.6% of the publicly analyzed corpus (40998 of 100981 samples) exhibits T1566.002. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats