What tactics and techniques does COLDRIVER use?

COLDRIVER is known for targeting credentials and sensitive information through phishing, account takeover, and post-compromise collection. Its operations typically rely on social engineering, malicious links or attachments, and follow-on access to email or cloud accounts. Defenders should monitor for suspicious authentication prompts, unusual mailbox access, consent abuse, and repeated attempts to recover or reset accounts.

How COLDRIVER Operates Across the Intrusion Chain

COLDRIVER’s playbook is built around gaining trust first, then harvesting credentials and using the resulting access to reach mailboxes, documents, and other sensitive material. That usually means social engineering rather than noisy malware. The group’s value comes from turning a small initial success into persistent access that looks like normal user activity until defenders correlate the pattern.

The initial lure is often a message, link, or attachment designed to get the target to hand over credentials or visit a malicious site. That step matters because it converts curiosity or routine business flow into an authentication event the adversary can reuse. Top 10 Phishing Techniques is a useful lens here because many of the tradecraft patterns used by COLDRIVER map to common phishing techniques such as link-based credential theft, consent abuse, and session capture.

Once an account is exposed, the follow-on activity is usually collection rather than destructive action. The attacker may search mail, pull attachments, review shared folders, or pivot to cloud services and identity workflows that let them stay hidden inside routine collaboration traffic. Because the access path is a legitimate account, the compromise often blends into ordinary login and mailbox behaviour until response teams inspect authentication history and cross-account activity.

What Techniques Defenders Should Expect to See

From a detection perspective, the most important techniques are credential harvesting, account takeover, mailbox access, consent abuse, and post-compromise collection. In practical terms, that means suspicious sign-in prompts, unfamiliar device or location patterns, OAuth consent grants that were not expected, and repeated password reset or recovery attempts. These are not isolated indicators, they are part of an access path that moves from lure to persistence.

COLDRIVER operations also tend to rely on follow-on privilege that comes from the victim’s own trust relationships. If the attacker gains access to email, they may use that mailbox to reach internal contacts, reset other accounts, or request additional access through trusted channels. MITRE ATT&CK Enterprise Matrix is a strong reference for mapping this chain to credential access, valid accounts, and collection techniques, which helps defenders translate a broad threat name into concrete hunt queries and response logic.

The operational pattern is especially important because this is not usually a smash-and-grab intrusion. The attacker wants durable access to information, so they often avoid actions that would immediately break the account. That makes mailbox rules, forwarding settings, unusual consent grants, and replayed authentication events more important than signature-based malware detection alone.

Why the Group’s Tactics Are Effective and Where They Break

These tactics work because they exploit the normal trust model of email, cloud identity, and collaboration systems. A legitimate account can read messages, receive password resets, approve prompts, and access shared data without triggering the kinds of alerts reserved for endpoint malware or obvious exfiltration. The attack therefore succeeds by staying close to approved user behaviour while quietly expanding access.

That same dependence on trust creates a defensive opening. If you centralise identity telemetry, preserve sign-in logs, and compare mailbox actions against the user’s normal patterns, the intrusion becomes easier to spot. NIST SP 800-63 Digital Identity Guidelines is useful where the question turns to authentication strength, because phishing-resistant authentication and stronger authenticator handling directly reduce the success rate of the initial takeover step.

Defenders should also assume that a successful phishing event may expose more than one account. Email compromise often becomes a launch point for additional account recovery abuse, OAuth abuse, or secondary credential capture. That means the threat is not limited to the first mailbox that was accessed, but to the surrounding identity and collaboration surface that the attacker can reach from it.

Risk and Threat Considerations

COLDRIVER’s tactics are high risk because they turn ordinary trust relationships into an access path, and the resulting compromise can remain low noise for a long time. The most dangerous phase is often after the first credential is stolen, when the attacker can use the victim’s own account to hide in normal business traffic.

Failure mechanism: Social engineering or a malicious link captures credentials or session access, then the attacker uses legitimate sign-in paths, mailbox access, and consent flows to persist and collect data.

Impact: Sensitive email, documents, and account relationships can be exposed, and the compromise can spread if the mailbox is used to reset other accounts or deceive additional targets.

Practitioner Guidance

What to verify: Correlate authentication events with mailbox activity, consent grants, and recovery attempts. If a user reports a suspicious prompt or link interaction, treat the surrounding sign-in history as part of the incident, not as separate noise.

Decision rule: If an account has abnormal logins and post-compromise mailbox access, rotate credentials and invalidate active sessions before spending time on content review. The access path matters more than the specific lure once the account is live.

Common mistake: Teams often over-focus on the phishing email itself and underinvest in the identity trail that follows. For this threat, the account behaviour after the click is usually the most actionable evidence.

Practitioner takeaway: The key question is not whether a lure looked convincing, but whether the attacker converted that lure into durable authenticated access that can be used quietly for collection.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?