Compromise Accounts
Account compromise for targeting takes over an existing online identity to support later operations.
What it means
Account compromise for targeting takes over an existing online identity to support later operations. Established relationships can lend credibility to fraudulent contact.
MITRE ATT&CK catalogs this behavior as T1586, within resource development. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A previously known external contact sends an unusual sensitive request after its account behavior changes.
Evidence to examine
Review message provenance, prior communications, account-change signals where available, and verification through independent channels.
A common analytical pitfall
A familiar account name does not prove the familiar person currently controls it.
Response considerations
Protect the targeted workflow, preserve communications, and verify requests through a separate trusted relationship before granting access or disclosing information.
Existing trust can be inherited by an attacker
A fictional supplier's genuine email account begins sending unusual requests to customers. Because the account has a real history and existing relationships, recipients may trust it more than a newly created address. That history does not guarantee the current sender has rightful control.
Investigate the account's control and the specific messages separately. Suspicious wording alone may be insufficient to prove takeover, while sign-in events, rule changes, or unauthorized activity can provide stronger evidence. Preserve timestamps and message details without copying active credentials into ordinary reports.
The compromised account may be a resource used to target another organization. Distinguish that preparatory use from a takeover of the recipient's own accounts. This helps incident teams coordinate with the supplier and avoid overstating the affected scope.
Trace authority across an existing relationship
For a tabletop exercise, describe a supplier account requesting a payment-detail change. Mark which facts are supported by the established relationship and which require a fresh verification. Explain why replying to the same compromised mailbox is not an independent confirmation of the request.
Containment may include revoking sessions, reviewing forwarding rules, changing credentials, and notifying affected parties through approved channels, depending on the evidence and authority available. The supplier's account owner should perform actions within their environment. Recipients should verify consequential requests through known independent contacts. A useful report describes the observed loss of account control and its subsequent use, while recognizing that the legitimate account owner may be a victim and that a familiar address is not a substitute for transaction-specific authorization.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1586: Compromise Accounts