TL;DR: Russian GRU unit 26165 is using password sprays, phishing, malware, weak authentication, mailbox permission abuse, and legacy protocols like NTLM to break identity trust and enter target environments, according to Axiad. Certificate-based authentication and PKI reduce exposure, but enterprises still need better lifecycle control and protocol retirement.
At a glance
What this is: This is an Axiad analysis arguing that state-sponsored intrusions increasingly succeed by breaking identity trust rather than by defeating perimeter controls.
Why it matters: It matters because IAM, PAM and NHI teams still have to retire weak authentication paths, because attackers can turn legacy protocols, mailbox permissions and exposed credentials into initial access even in otherwise well-defended environments.
Context
State-sponsored intrusion campaigns often begin with identity rather than with infrastructure compromise. In this case, the article frames Russian GRU unit 26165 activity as a campaign against identity trust, using password sprays, phishing, malware, mailbox permission abuse and legacy protocols to obtain access.
For identity programmes, the problem is not only stronger authentication at login. The deeper issue is that weak authentication paths, legacy protocols such as NTLM and brittle mailbox permission models still expand the attack surface even where other controls are in place.
Key questions
A: Attackers gain multiple low-friction entry paths that bypass strong perimeter controls and turn trusted identity systems into the compromise route. Weak authentication, mailbox permission abuse and older protocols such as NTLM let adversaries reuse legitimate access patterns instead of forcing noisy exploitation. That is why identity modernisation is a core security control, not a convenience project.
Q: Why do attackers target identity infrastructure soon after they get a foothold in a network?
A: Attackers target identity infrastructure because it offers the fastest path to escalation, persistence, and broader access. In Active Directory, compromised credentials or misconfigurations can let an intruder move laterally, create backdoors, and bypass normal business controls. Identity is often the control plane that determines whether an initial intrusion stays contained or turns into a full breach.
Q: What signs show that mailbox permissions or legacy authentication are creating hidden risk?
A: Watch for unusual delegated mailbox access, repeated password-spray activity, unexplained use of older authentication methods and access that persists without a clear business owner. These signals often indicate that identity trust is being abused rather than broken outright. If they appear together, the environment likely has an exposure window that is wider than it should be.
Q: Should organisations prioritise PKI over password-based authentication in hybrid environments?
A: Where organisations still depend on on-premises systems, remote access and high-value accounts, phishing-resistant authentication is usually the better direction because it reduces replay, guessing and MFA fatigue exposure. PKI is not a standalone fix, though. It works when lifecycle control, revocation and protocol retirement are governed with the same discipline as the login path itself.
Technical breakdown
How identity trust is broken before network compromise
The article describes a campaign that starts with credential and trust manipulation, not with exploit chains against the network layer. Password spraying and phishing work because authentication still relies on human-fallible secrets and approval flows, while mailbox permission abuse turns delegated access into an entry path. In practice, the attacker is not defeating encryption or perimeter tooling first. They are using identity weaknesses to obtain a valid foothold, then moving through trusted services that already accept those identities as legitimate. That is why identity controls sit upstream of many downstream detections.
Practical implication: treat weak authentication and delegated access as primary intrusion paths, not secondary hygiene issues.
Why legacy protocols and weak mailbox permissions widen exposure
Legacy protocols such as NTLM preserve compatibility, but they also preserve older trust assumptions that are easier to abuse. When paired with misconfigured mailbox permissions, attackers can pivot from initial access to broader account use without needing to break modern controls directly. This is not a theoretical architecture problem. It is a live governance issue because the environment continues to accept authentication and authorisation patterns that were designed before current phishing, replay and credential-theft tradecraft matured.
Practical implication: inventory and retire legacy authentication paths while correcting mailbox delegation and permission sprawl.
Why certificate-based authentication changes the trust model
Certificate-based authentication and PKI change the shape of the problem by replacing guessable or replayable credentials with cryptographic proof of identity. That does not eliminate governance work, because certificates still require issuance, renewal, revocation and policy enforcement across hybrid environments. But it does reduce exposure to password guessing and MFA fatigue attacks, and it aligns better with identity-centric Zero Trust assumptions. The value is less about a stronger login and more about making identity harder to impersonate at scale.
Practical implication: use PKI as part of a broader authentication-modernisation programme, not as a standalone control.
Threat narrative
Attacker objective: The objective is to gain durable access through identity compromise so the operators can conduct espionage inside target environments.
- Entry begins with password sprays, phishing and abuse of weak authentication paths to obtain a valid identity foothold.
- Credential and permission abuse follow through mailbox misconfiguration, legacy protocols and vulnerable VPN or on-prem access paths.
- Escalation comes from reusing trusted identity relationships rather than from loud malware activity alone.
- Impact is persistent espionage access into logistics and technology environments supporting Ukraine.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity trust, not perimeter strength, is the decisive battlefield in this campaign. The article shows that state-sponsored operators are targeting authentication paths, delegated mailbox access and legacy identity protocols because those controls still determine whether an intruder is accepted as legitimate. That shifts the governance question from network hardening to trust boundary design. Enterprises should read this as a signal that identity infrastructure now carries the first-order risk.
Legacy authentication creates a memory of trust that attackers can still exploit. NTLM and similar protocols persist because they preserve operational compatibility, but they also preserve the assumptions that made older attack paths viable. Once those assumptions remain in production, the enterprise is carrying inherited risk forward into modern threat conditions. Practitioners should treat protocol retirement as a security decision, not a platform preference.
Mailbox permissions are identity infrastructure, not administrative convenience. The article’s emphasis on mailbox permission abuse is important because it shows how delegated access can become a covert entry path when governance is weak. If permission models are loose, attackers do not need to defeat the whole environment. They only need one trusted identity relationship that was never tightened or reviewed.
Certificate-based authentication is a governance control, not just a stronger login. PKI changes the impersonation model by tying access to cryptographic proof rather than reusable secrets, which reduces exposure to spray and replay techniques. But the control only works when issuance, renewal, revocation and policy enforcement are managed across the full lifecycle. The practitioner conclusion is that authentication modernisation and lifecycle discipline have to move together.
Identity infrastructure is now part of national-actor intrusion strategy, so governance maturity must match the adversary. This is not ordinary phishing at scale. It is a sustained campaign that treats identity systems as the shortest path to trusted access, which means IAM, PAM and NHI teams have to align operational priorities with state-level tradecraft. The implication is clear: identity security is no longer downstream of intrusion detection, it is upstream of compromise prevention.
What this signals
Identity trust gap: Campaigns like this show that authentication, delegation and protocol choice are now the main attack surface, so modern identity programmes have to be judged by how much legacy trust they still carry.
Enterprises with hybrid identity estates should expect legacy protocols, mailbox delegation and weak authentication to remain attractive entry points until they are explicitly retired or constrained.
For practitioners
- Retire legacy authentication paths Prioritise NTLM and other older trust mechanisms for removal where application dependencies allow, then track remaining exceptions as explicit risk items rather than background technical debt.
- Tighten mailbox delegation and permissions Review mailbox permissions, inherited access and delegated administration paths that could let an attacker use a trusted account without creating obvious authentication failures.
- Expand phishing-resistant authentication Increase coverage for certificate-based authentication and other phishing-resistant credentials in hybrid environments that still support on-premises systems and remote access.
- Treat certificate lifecycle as operational governance Formalise issuance, renewal, policy enforcement and revocation so PKI does not become another unmanaged trust layer inside the identity stack.
- Hunt for identity-led intrusion patterns Correlate password spray signals, mailbox permission anomalies and legacy protocol use to identify campaigns that are trying to break identity trust before broader compromise becomes visible.
Key takeaways
- State-sponsored intrusion is increasingly an identity problem, with weak authentication and delegated access doing the work that perimeter compromise once did.
- The article points to password sprays, phishing, mailbox permission abuse and legacy protocols as the practical mechanisms behind the campaign.
- Phishing-resistant authentication helps, but lifecycle control and protocol retirement are the controls that reduce the attack surface over time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Weak authentication and replayable credentials are central to the intrusion path described here. |
| NHI-07 — Long-Lived Secrets | Legacy identity paths and reusable credentials increase persistence of trust abuse. | |
| Recommendation — Reduce exposure by replacing replayable authentication paths with phishing-resistant controls. Inventory and retire long-lived authentication dependencies that attackers can repeatedly target. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate lifecycle and credential governance are central to the article's PKI argument. |
| Recommendation — Apply authenticator management to issue, renew, revoke and retire credentials under control. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Password sprays, phishing and mailbox abuse map to credential access and follow-on movement. |
| Recommendation — Map the campaign to credential access and lateral movement to improve detection priorities. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Mailbox permissions and identity authorisation are a direct control issue in the article. |
| Recommendation — Review permissions and entitlements to remove excess identity trust paths from production. | ||
Key terms
- Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
- Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.
- Mailbox Rule Abuse: Mailbox rule abuse occurs when an attacker creates or changes email rules to redirect, hide, or preserve messages. It is an identity risk because the attacker is using legitimate platform behaviour to maintain visibility and persistence after access, often without triggering obvious authentication alerts.
- Certificate Lifecycle Management: The governance of digital certificates from issuance through renewal and revocation, ensuring certificates are valid, monitored, and rotated before expiry. Expired certificates are a leading cause of outages and unplanned security gaps.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org