APT40 (Leviathan) commonly uses spear phishing, exploitation of internet-facing systems, credential theft, and web shells for initial access and persistence. It then uses lateral movement and collection activity to reach sensitive data. Defenders should prioritise patching exposed services, monitoring for web shell indicators, and reviewing unusual logins and internal administrative activity.
How APT40 Operationalises Access, Persistence, and Collection
APT40’s playbook is built around gaining a foothold quickly, then preserving access long enough to reach useful systems. Spear phishing and exposed-system exploitation give it multiple initial access paths, while web shells and stolen credentials help it blend into normal administration and extend dwell time.
The practical lesson is that these techniques are not isolated, they reinforce one another. If one path fails, the group can often pivot to another entry point, then use internal trust, valid accounts, and remote management activity to continue the operation.
That is why defenders should read the campaign as an access-and-control problem, not just a malware problem. The most important signals often appear in authentication logs, administrative activity, and changes on internet-facing hosts rather than in a single obvious payload.
Where the Technique Chain Usually Starts
The initial phase commonly begins with phishing content that persuades a user to open a malicious attachment, follow a link, or disclose credentials. In parallel, exploitation of public-facing systems gives the actor a direct route when exposed services are not patched or hardened.
Those two paths matter because they target different weaknesses. Phishing depends on user interaction and trust, while exploitation depends on internet exposure and an uncorrected flaw. In both cases, the goal is the same: get code execution or valid access with as little noise as possible.
Once access is established, the actor may deploy a web shell to maintain a lightweight remote command channel. That makes remediation harder, because the host can look superficially normal while still serving as a persistent entry point for follow-on actions.
What Happens After the First Foothold
After initial access, the observed behaviour shifts toward staging, internal discovery, lateral movement, and collection. That sequence is designed to identify where valuable information sits and which internal accounts or systems can be reached without immediately triggering alarms.
Credential theft is especially important in that phase because it turns a single compromised host into an access bridge. When the actor obtains reusable credentials, it can move laterally, operate as a trusted user, and reduce reliance on the original exploit path.
To understand the chain clearly, it helps to separate access from objective. The first stage is about entering and staying in the environment; the later stage is about reaching sensitive data, often through legitimate-looking internal actions that can be mistaken for routine support work.
Risk and Threat Considerations
APT40’s technique mix creates compound risk because one weak point can unlock several others, especially when exposed services, weak credential hygiene, and poor internal monitoring overlap. The same compromise can produce both persistence and lateral movement, which increases the chance of data collection before defenders notice.
Failure mechanism: Public-facing systems, phishing capture, or stolen credentials provide initial access, then web shells and valid accounts let the actor operate through ordinary administration channels and avoid simple perimeter-based detection.
Impact: The organisation can lose sensitive internal data, expose administrative pathways, and spend more time on containment because the intrusion looks like normal logins and internal activity rather than a single obvious malicious event.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | APT40 uses internet-facing exploitation for initial access. |
| T1566 — Phishing | Spear phishing is a core initial-access technique in the answer. | |
| T1053 — Scheduled Task/Job | Web shells and post-compromise persistence often pair with automated execution mechanisms. | |
| Recommendation — Hunt for exploitation of exposed systems and validate patching on internet-facing services. Detect and block phishing delivery paths before users can open or submit credentials. Review host persistence mechanisms and remove attacker-controlled execution paths. | ||
Practitioner Guidance
What to prioritise: Treat externally exposed systems and login activity as the highest-value monitoring points. If a host is internet-facing or an account shows unusual internal use, assume it may be part of a broader chain rather than a standalone alert.
What to verify: Confirm whether recent authentication events, shell creation, unusual command execution, or admin tool use line up with expected business activity. For a group like APT40, the important question is not only whether an alert fired, but whether the actor could persist and move laterally after the first entry point.
Practitioner takeaway: The best defence is to break the chain early, because once valid credentials and a web shell are both in play, the intrusion can shift from noisy access to quiet internal collection very quickly.