Confucius is associated with spearphishing, malicious documents, credential harvesting and long-running espionage access. The group often uses social engineering to deliver malware and then maintains persistence while collecting information. Defenders should look for suspicious email attachments, unexpected child processes from office applications, unusual logins and changes to autorun or scheduled execution.
How Confucius Operates as a Spearphishing and Espionage Cluster
Confucius is best understood as a social-engineering-led intrusion set rather than a single exploit chain. The group blends spearphishing, malicious documents and credential harvesting to get an initial foothold, then uses that access to support long-running espionage. That mix matters because the intrusion is designed to look like ordinary user activity while quietly creating durable access.
The first stage usually relies on convincing delivery rather than technical novelty. A forged message or booby-trapped attachment can be enough to trigger code execution or credential capture, after which the operator shifts from delivery to persistence and collection. For a useful threat-overview baseline, compare observed behaviour to the attack patterns in MITRE ATT&CK Enterprise Matrix.
That matters operationally because the visible event is often the delivery vector, while the real objective is continued access. A campaign may start with a document lure, but defenders should think in terms of the full chain: initial access, execution, credential access, persistence and collection. That is the level at which the group’s tactics become actionable.
What the Initial Access and Persistence Pattern Looks Like
Confucius commonly uses email-based social engineering to push malware or harvest credentials, then uses the resulting access to remain in environment for extended periods. Malicious documents can serve as the execution trigger, but the attacker’s value comes from blending into normal office workflows and reusing legitimate channels after compromise.
The persistent phase often leaves weaker signals than the initial delivery phase. Unexpected child processes spawned by office applications, unusual authentication events, and new autorun or scheduled-task entries are more useful indicators than a single malicious attachment. The same pattern also maps cleanly to enterprise hunting logic for email-borne intrusion chains in Top 10 Phishing Techniques.
In practice, the group’s long-running access depends on defenders treating phishing as a one-time event instead of the start of a campaign. If the attacker successfully captures credentials or keeps a foothold on one endpoint, they can pivot into mailbox access, file access or additional internal recon without needing to repeat the original lure.
Why Defender Detection Has to Focus on Behaviour, Not Just the Lure
Because the initial message may look routine, the better detection strategy is to correlate the lure with post-delivery behaviour. Look for anomalous email attachments, document-triggered spawning of shell or script processes, new persistence mechanisms, and logins that do not match the user’s normal pattern or location.
That behavioural approach is especially important when the attacker is using harvested credentials rather than repeated malware drops. Once an account is abused, the original phishing artefact may disappear from view while the session, mailbox or endpoint activity continues. For defenders building kill-chain coverage, ATT&CK is the best open reference for linking credential access, persistence and collection to concrete hunt hypotheses.
Where available, endpoint telemetry and authentication logs should be joined early, not after an incident escalates. The practical value is not just detecting the first malicious attachment, but identifying whether the same campaign has already reached identity abuse, lateral movement or sustained espionage access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Confucius uses spearphishing and malicious delivery as its entry path. |
| T1078 — Valid Accounts | Credential harvesting and long-running access imply abuse of legitimate accounts. | |
| T1053 — Scheduled Task/Job | Persistence via scheduled execution is a stated defender signal in this campaign type. | |
| Recommendation — Map delivery artefacts to phishing techniques and hunt for post-click execution. Prioritise anomalous logins and revoke abused credentials fast. Check persistence mechanisms and remove unauthorized scheduled execution. | ||
Practitioner Guidance
What to prioritise: Treat suspicious email delivery and unusual authentication as a single investigation path, not separate tickets. If a user opened an attachment and then logged in from an odd context, assume the campaign may already have moved from execution to credential abuse.
What to verify: Confirm whether the attachment launched an unexpected child process, created persistence, or led to mailbox or VPN logins outside the user’s normal pattern. That combination is more decisive than any one alert by itself.
Practitioner takeaway: The key judgement is to hunt for the attacker’s retained access, not just the phishing message that created it. If you only block the lure, you may miss the part of the campaign that matters most.