Topic starter
12/06/2026 10:04 pm
TL;DR: Russian GRU unit 26165 is using password sprays, phishing, malware, weak authentication, mailbox permission abuse, and legacy protocols like NTLM to break identity trust and enter target environments, according to Axiad. Certificate-based authentication and PKI reduce exposure, but enterprises still need better lifecycle control and protocol retirement.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “State-Sponsored Cyber Threats—Is Your Identity Infrastructure Ready?”.
Key questions
A: Attackers gain multiple low-friction entry paths that bypass strong perimeter controls and turn trusted identity systems into the compromise route.
Q: Why do attackers target identity infrastructure soon after they get a foothold in a network?
A: Attackers target identity infrastructure because it offers the fastest path to escalation, persistence, and broader access.
Q: What signs show that mailbox permissions or legacy authentication are creating hidden risk?
A: Watch for unusual delegated mailbox access, repeated password-spray activity, unexplained use of older authentication methods and access that persists without a clear business owner.
Practitioner guidance
- Retire legacy authentication paths Prioritise NTLM and other older trust mechanisms for removal where application dependencies allow, then track remaining exceptions as explicit risk items rather than background technical debt.
- Tighten mailbox delegation and permissions Review mailbox permissions, inherited access and delegated administration paths that could let an attacker use a trusted account without creating obvious authentication failures.
- Expand phishing-resistant authentication Increase coverage for certificate-based authentication and other phishing-resistant credentials in hybrid environments that still support on-premises systems and remote access.
Bottom line: State-sponsored intrusion is increasingly an identity problem, with weak authentication and delegated access doing the work that perimeter compromise once did.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:35 am
Identity trust, not perimeter strength, is the decisive battlefield in this campaign. The article shows that state-sponsored operators are targeting authentication paths, delegated mailbox access and legacy identity protocols because those controls still determine whether an intruder is accepted as legitimate. That shifts the governance question from network hardening to trust boundary design. Enterprises should read this as a signal that identity infrastructure now carries the first-order risk.
A question worth separating out:
Q: Should organisations prioritise PKI over password-based authentication in hybrid environments?
A: Where organisations still depend on on-premises systems, remote access and high-value accounts, phishing-resistant authentication is usually the better direction because it reduces replay, guessing and MFA fatigue exposure. PKI is not a standalone fix, though. It works when lifecycle control, revocation and protocol retirement are governed with the same discipline as the login path itself.
👉 Read our full editorial: Identity infrastructure is not ready for state-sponsored intrusion
This post was modified 6 days ago by NHI Mgmt Group