How can organisations defend against APT10?

What APT10’s Tactics Mean for Defence

APT10 defence works best when you assume the intruder wants durable access, not a one-time exploit. That shifts attention toward the identity layer, the paths used for administration, and the routes data can leave by. The practical goal is to make stolen credentials less useful, remote access more observable, and any persistence easier to spot before it becomes long-lived access.

Because the group is associated with credential theft and follow-on access, defenders should treat authentication hardening as a primary control, not a supporting one. Phishing-resistant MFA, tighter privileged access, and review of reused credentials matter because they directly reduce the value of stolen passwords and tokens. For broader group context and naming discipline, use Threat Actor Groups Guide when mapping reporting, aliases, and campaign intelligence to the same actor set.

Remote administration paths also need special scrutiny. If an attacker can blend in through ordinary remote tools, then a flat trust model gives them room to persist, move laterally, and blend command activity into normal operations. Segmentation of admin access, restrictions on where privileged sessions can originate, and logging on unusual remote tooling all help reduce that hidden movement space.

How to Reduce the Access Paths APT10 Commonly Abuses

Start with the trust relationships that make compromise scalable. Third-party access, shared admin pathways, legacy remote access, and duplicated credentials across environments are the places where a single stolen secret can become repeated access. If those routes are not constrained, containment becomes much harder because the attacker can pivot without needing a fresh exploit every time.

Restrict privileged accounts to the smallest possible set of systems and administrators, and make administrative paths distinct from ordinary user paths. That means stronger separation between day-to-day user activity and management activity, plus tighter controls on which hosts, jump points, or VPN paths can reach sensitive systems. The point is not only to prevent initial compromise, but to limit where a compromised credential can operate.

Review exposed systems and any remotely reachable management surface that is accessible from the internet or from partner networks. Where patching is delayed, compensate by narrowing exposure, disabling unnecessary services, and increasing alerting on authentication anomalies, new tooling, and unusual session timing. NIST Privacy Framework is not the primary source for this problem, but its governance language is useful when organisations need to tie access monitoring to data handling impact and classification.

Data egress matters because long-term access usually shows up in movement before it shows up in overt disruption. Monitor for bulk transfer, unusual archive creation, unexpected encryption or staging activity, and destinations that do not fit the business process. This is where egress control and anomaly detection complement identity hardening: one limits what can leave, the other helps show that exfiltration is in progress.

What to Hunt for After Hardening the Perimeter

Once the obvious exposure is reduced, look for evidence that credentials or sessions were already abused. Suspicious persistence, unusual service creation, remote tools that do not belong in the environment, and repeated access from the same credentials across multiple systems are all signs that the compromise may be broader than a single host. Hunting should focus on whether the attacker established repeatable access, not just whether one malware sample was removed.

Hunt especially for credential reuse across environments, because that can turn one breach into multiple entry points. If the same account or secret works in development, production, or partner-connected systems, containment is incomplete. MITRE ATT&CK Enterprise Matrix is useful here because it helps defenders map observed behaviour to credential access, persistence, lateral movement, and evasion patterns rather than treating each alert in isolation.

When reviewing telemetry, pay close attention to remote login success from unusual geographies, tools that create scheduled access, and privilege use that does not match the account owner’s normal role. Those signals are especially valuable when the attacker is trying to look like routine administration. If the environment includes cloud or API-heavy administration, NIST Cybersecurity Framework 2.0 remains a useful organising model for connecting protect, detect, respond, and recover work across teams.

Risk and Threat Considerations

APT10-style intrusions are dangerous because the attacker’s strongest advantage is duration. If stolen credentials, weak remote access, or overbroad third-party connectivity remain usable, the compromise can persist quietly while the defender focuses on a single alert or host. The real risk is not just initial intrusion, but repeated access, hidden movement, and data exposure over time.

Failure mechanism: Stolen credentials, weak administrative boundaries, and insufficient egress monitoring allow the attacker to re-enter, pivot, and exfiltrate without triggering a clean containment boundary.

Impact: Organisations can lose visibility into which systems are trusted, which accounts are compromised, and what data has already been accessed or staged for removal.

Practitioner Guidance

What to prioritise: Treat privileged identity and remote administration as the highest-value control plane. If those controls are weak, patching alone will not stop repeat access.

What to verify: Confirm that privileged accounts are not reusable across environments, that MFA is phishing-resistant, and that remote admin tools are restricted to approved paths and hosts. If any of those assumptions fail, treat the environment as still exposed.

Decision rule: If you cannot prove that a compromised credential cannot reach sensitive systems, assume the attacker can still move and focus on containment, rotation, and hunting before declaring recovery complete.

Practitioner takeaway: The most effective defence is to make stolen access short-lived, constrained, and visible, because long-term persistence is what turns an intrusion into an enduring breach.

Related resources from NHI Mgmt Group

• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?
• How can organisations defend against AI-generated phishing and impersonation?