How can organisations defend against APT-C-36?

How APT-C-36 typically gains access

APT-C-36 is the kind of intrusion set that succeeds by blending impersonation, credential theft, and follow-on access to mail, cloud, and remote services. The practical lesson is that initial compromise is often less about exploit sophistication and more about whether email trust, identity controls, and user verification break down together.

That means defenders should treat mail as a primary entry point, not just a communication channel. If phishing, lookalike domains, or reply-chain abuse can reach users, the attacker has a path to steal credentials, register persistent inbox rules, and pivot into higher-value accounts with the same access path.

For a useful threat-actor reference point, the broader campaign context matters more than the label itself, so a group-intelligence guide such as Threat Actor Groups Guide helps frame how APT naming, aliases, and tactics are used in practice.

Controls that interrupt the intrusion chain

The best defensive posture is to break the chain at multiple points: stop impersonation from landing, make stolen credentials less useful, and make suspicious access visible quickly. Email filtering, domain protection, and user awareness reduce the chance that the first lure succeeds; multi-factor authentication raises the cost of credential theft; and strong privilege boundaries limit how far a compromised account can move.

Access control needs to be enforced consistently across remote access, SaaS, and administrative workflows. If users can authenticate to cloud apps without strong verification, or if privileged accounts share weak recovery paths, the attacker can convert one stolen login into durable access. That is why password reuse, weak recovery settings, and long-lived sessions are all part of the same defensive problem.

This is also where identity logs become operationally important. Repeated failed logins, impossible-travel patterns, new-device prompts, mailbox rule changes, and sudden privilege changes are often more useful than a single alert because they show the attack progressing, not just attempting entry. A breach is easier to contain when those signals are reviewed as part of the normal detection workflow.

When the intrusion pattern involves credential abuse rather than malware-heavy tradecraft, Microsoft Midnight Blizzard breach is a useful parallel because it shows how missing MFA and legacy access paths can turn an old account into a fresh foothold.

Where organisations usually under-defend

Many teams harden the perimeter but leave identity and email pathways too permissive. The usual weak spots are accounts that can still authenticate from unmanaged devices, poorly monitored inbox automation, broad admin roles, and exposed systems that remain reachable long after they should have been retired or patched. APT-C-36 style activity benefits from exactly that mismatch between front-line awareness and weak back-end access discipline.

Another common mistake is treating mailbox compromise as a user problem instead of an enterprise access problem. Once an attacker can create hidden forwarding or inbox rules, they may be able to siphon sensitive messages, reset passwords, or intercept business processes without triggering obvious endpoint alerts. In that state, the compromise is no longer local to one user account.

Groups that rely on stolen credentials and persistence often reuse the same playbook across environments. The Salt Typhoon telecom intrusions 2025 case is a reminder that credential abuse, device access, and persistence can compound when defenders do not tightly govern authentication and privileged access.

Risk and Threat Considerations

APT-C-36 style activity is dangerous because it turns ordinary trust relationships, especially email and remote sign-in, into durable access paths. If identity signals are weak or unreviewed, an attacker can remain hidden long enough to reset accounts, alter routing, or use a victim mailbox as a launch point for further impersonation.

Failure mechanism: Attackers exploit user trust, weak authentication, and mailbox-level persistence to turn one successful login into repeated access and internal reach.

Impact: Organisations can lose message integrity, confidentiality, and account control, and may not notice until fraud, lateral access, or privilege misuse is already underway.

Practitioner Guidance

What to prioritise: Put email security, MFA coverage, and privilege reduction ahead of broad awareness campaigns alone. If an account can sign in remotely, access cloud services, and read mail, it needs stronger verification than a standard office account.

What to verify: Confirm that mailbox rule changes, new-device logins, repeated failed authentications, and legacy access paths are being logged and actively reviewed. Also verify that password resets, recovery flows, and administrative exceptions cannot be abused to bypass MFA.

Decision rule: If a suspicious login is confirmed, rotate credentials and inspect mailbox forwarding, delegated access, and session state before assuming the event is contained. If you find evidence of persistence, treat the account as a compromise investigation rather than a simple reset case.

Practitioner takeaway: The effective defence is not one control, but the ability to detect when email trust and identity trust are being converted into persistence before the attacker can normalise inside the environment.

Related resources from NHI Mgmt Group

• How can organisations defend against APT-C-23?
• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?