BEC: data theft (W-2/PII)

Spoofed email solicits employee PII or tax forms for follow-on fraud

Example: IC3 PSA240911

Classification

28 values: 13 imported, 1 derived, 14 machine-classified. What do these mean?

Exploitability

Impact & scope

Detection & telemetry

Detection & response

Mitigated by 40

• M1017 attack-mitigation
• M1021 attack-mitigation
• M1031 attack-mitigation
• M1047 attack-mitigation
• M1049 attack-mitigation
• M1054 attack-mitigation
• D3-APCA d3fend
• D3-CF d3fend
• D3-CM d3fend
• D3-CQ d3fend
• D3-CSPP d3fend
• D3-DA d3fend
• D3-DF d3fend
• D3-DI d3fend
• D3-EF d3fend
• D3-EFA d3fend
• D3-ER d3fend
• D3-FA d3fend
• D3-FE d3fend
• D3-FEV d3fend
• D3-FIM d3fend
• D3-HD d3fend
• D3-IAA d3fend
• D3-ISVA d3fend
• D3-ITF d3fend
• D3-LFP d3fend
• D3-NTCD d3fend
• D3-NTF d3fend
• D3-NTSA d3fend
• D3-PHDURA d3fend
• D3-PMAD d3fend
• D3-RE d3fend
• D3-RF d3fend
• D3-RFAM d3fend
• D3-RTSD d3fend
• D3-SMRA d3fend
• D3-SRA d3fend
• D3-UA d3fend
• D3-UGLPA d3fend
• D3-URA d3fend

Detected by 36

• DET0070 attack-detection-strategy
• 00d0b5ab-1f55-4120-8e83-487c0a7baf19 sigma
• 023394c4-29d5-46ab-92b8-6a534c6f447b sigma
• 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073 sigma
• 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 sigma
• 1ae64f96-72b6-48b3-ad3d-e71dff6c6398 sigma
• 1cdd9a09-06c9-4769-99ff-626e2b3991b8 sigma
• 24de4f3b-804c-4165-b442-5a06a2302c7e sigma
• 295a59c1-7b79-4b47-a930-df12c15fc9c2 sigma
• 2f9356ae-bf43-41b8-b858-4496d83b2acb sigma
• 32b5db62-cb5f-4266-9639-0fa48376ac00 sigma
• 3569aefd-e535-4391-8c18-24bd01a21eaf sigma
• 38e7f511-3f74-41d4-836e-f57dfa18eead sigma
• 4358e5a5-7542-4dcb-b9f3-87667371839b sigma
• 4c55738d-72d8-490e-a2db-7969654e375f sigma
• 52cad028-0ff0-4854-8f67-d25dfcbc78b4 sigma
• 538c5851-8c03-4724-8ec4-623bc7aadaea sigma
• 571498c8-908e-40b4-910b-d2369159a3da sigma
• 678eb5f4-8597-4be6-8be7-905e4234b53a sigma
• 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4 sigma
• 864403a1-36c9-40a2-a982-4c9a45f7d833 sigma
• 91174a41-dc8f-401b-be89-7bfc140612a0 sigma
• 932ac737-33ca-4afd-9869-0d48b391fcc9 sigma
• a018fdc3-46a3-44e5-9afb-2cd4af1d4b39 sigma
• ad7085ac-92e4-4b76-8ce2-276d2c0e68ef sigma
• b1c50487-1967-4315-a026-6491686d860e sigma
• b5de2919-b74a-4805-91a7-5049accbaefe sigma
• bf241472-f014-4f01-a869-96f99330ca8c sigma
• c27515df-97a9-4162-8a60-dc0eeb51b775 sigma
• dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c sigma
• e0e121d0-be4d-4281-af7e-17abbba4a408 sigma
• e8a95b5e-c891-46e2-b33a-93937d3abc31 sigma
• ee39a9f7-5a79-4b0a-9815-d36b3cf28d3e sigma
• fabb0e80-030c-4e3e-a104-d09676991ac3 sigma
• fcdf69e5-a3d3-452a-9724-26f2308bf2b1 sigma
• fdd84c68-a1f6-47c9-9477-920584f94905 sigma

Tested by 3

• 114ccff9-ae6d-4547-9ead-4cd69f687306 atomic
• bc177ef9-6a12-4ebc-a2ec-d41e19c2791d atomic
• cbb6799a-425c-4f83-9194-5447a909d67f atomic

Attack relationships

• Child: Angler phishing
• Child: Browser-in-the-browser (BitB)
• Child: Callback phishing (TOAD)
• Child: Clone phishing
• Child: Fake job / recruiter lure
• Child: Malspam
• Child: Phishing-as-a-service (PhaaS)
• Child: Spear phishing
• Child: Spear phishing via service
• Child: Vishing

Framework references

• Primary source: https://www.ic3.gov/PSA/2024/PSA240911
• attack: T1566 (primary)

Evidence & sources

• ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Social engineering and human-targeted attacks' table, line 28 of Cyber-Attack-Taxonomy.md
• ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1566 as the nearest framework entries; ids verified to exist in the cached catalogues.
• ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 11 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)