| ID | Name |
|---|---|
| T1683.001 | Written Content |
| T1683.002 | Audio-Visual Content |
Adversaries may create or tailor written materials to support targeting and malicious operations. Content may include phishing lures, fraudulent financial communications, fabricated job postings, fabricated employment credentials and documentation, decoy documents, social media persona content, and supporting narratives used to sustain fabricated personas over time.[1][2] Content may be authored manually, commissioned through third parties, or produced using AI-assisted tools.
Written materials may impersonate legitimate government correspondence, diplomatic communications, or internal organizational documents to support targeting efforts. AI-assisted tools may also be used to tailor content to specific targets, industries, or regions. For example, adversaries may leverage AI to translate content into a target's native language or mimic the communication style of trusted senders.
Written content produced through these methods may be used in support of other techniques, such as Phishing, Spearphishing via Service, Phishing for Information, Internal Spearphishing, Social Engineering, Financial Theft, or Establish Accounts.
Written content does not include malicious code or scripts; for development of malicious code and scripts, see Develop Capabilities.
| ID | Name | Description |
|---|---|---|
| C0064 | AI-Assisted Breach of Mexico's Government Infrastructure |
During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to generate forged tax compliance certificates with the data collected by custom python scripts.[3] |
| G0099 | APT-C-36 |
APT-C-36 has generated email content impersonating official notifications and documents that direct victims to execute malicious payloads.[4] |
| G0082 | APT38 |
APT38 has created decoy content that resembles legitimate guidance for support to victims that contain hidden malicious actions.[5] |
| G1052 | Contagious Interview |
Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.[6] |
| S9044 | Kali365 |
Kali365 has generated tailored branded phishing lures to target victims utilizing a myriad of reputable services and brands that entice users to interact with the content.[7][8][9][10] Kali365 has also been enabled with AI such as Claude Sonnet that evaluates emails and generates tailored responses to facilitate BEC activities.[10] |
| G1059 | NIMBUS MANTICORE |
NIMBUS MANTICORE has created career-themed phishing lures to entice victims.[11][12] |
| G1056 | TeamPCP |
TeamPCP has created Dune-themed GitHub repositories using stolen tokens.[13] |
| G1058 | The Gentlemen |
The Gentlemen has utilized branded code and ransom notes.[14][15][16][17][18][19] |
| ID | Mitigation | Description |
|---|---|---|
| M1056 | Pre-compromise |
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on designing defenses that are not reliant on atomic indicators. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0917 | Detection of Written Content | AN2060 |
Much of this takes place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access. |