How can organisations defend against APT38?

How APT38 defence should be structured around financial control points

apt38 is best defended against by making the payment environment harder to abuse at the points where value actually moves. That means strong access control for banking systems, segmented trust boundaries, dual approval for high-value transfers, and monitoring around transaction templates, approvals, and remote access into financial workflows.

A useful operating model is to treat payment integrity as both an access problem and a workflow integrity problem. If an attacker can reach transfer systems, alter templates, or use privileged access to approve activity, the organisation has already lost more than one control layer.

Protecting the environment also means limiting the blast radius of administrative compromise. If backup recovery, core banking, or payment orchestration shares the same administrator trust path, an attacker can potentially tamper with recovery and delay containment at the same time.

What defenders should watch for in payment and treasury environments

The most important warning signs are changes that affect authorisation and settlement, not just malware on endpoints. Look for unusual transfer approval patterns, new or altered beneficiary templates, suspicious remote access, and privileged account activity outside normal operating windows. Those signals matter because the objective is often fraudulent movement of funds rather than simple disruption.

Monitoring should be tuned to the business process, not only to infrastructure telemetry. A login anomaly is relevant, but a changed payment template, an unexpected dual-approval bypass, or a privileged session touching treasury systems is often the stronger indicator of active abuse.

Detection is also more effective when it covers the chain from access to action. An attacker who cannot directly transfer funds may still stage the environment by editing templates, creating look-alike approval paths, or using an administrative session to mask later fraud.

Why containment has to include segmentation, recovery, and privileged review

Defence fails when payment systems, administrative tooling, and recovery functions are too closely linked. Network segmentation, restricted internet exposure, and separate control paths for privileged administration help prevent one compromised credential from becoming broad financial-system reach.

Recovery deserves special attention because it is often targeted after initial access. If the same administrators can both operate the environment and alter backups or restore points, the organisation may be unable to trust recovery during an incident.

That is why privileged access review is not a compliance task here, it is an incident-prevention control. Reviewing who can approve, who can alter templates, who can reach payment infrastructure, and who can touch recovery systems directly reduces the attacker’s ability to turn access into theft.

Risk and Threat Considerations

APT38-style activity is high impact because payment systems concentrate both trust and value. If transaction approvals, remote administration, or recovery controls are weak, a single compromise can be converted into fraud, delayed detection, and slower recovery across critical financial workflows.

Failure mechanism: Attackers abuse privileged access or workflow manipulation to change payment instructions, bypass approval controls, or interfere with recovery, then use normal-looking administrative activity to conceal the fraud long enough for transfers to complete.

Impact: Organisations can lose funds, lose confidence in transaction integrity, and face extended disruption if the same trust paths used for operations also protect backups, approvals, and administrative override functions.

Practitioner Guidance

What to prioritise: Start with the systems that can move money or change payment state, then map who can approve, amend, or override those workflows. Those are the controls that determine whether a compromise becomes a theft event.

What to verify: Confirm that dual approval is enforced in the actual payment path, not only in policy documents, and verify that privileged access is logged, reviewed, and separated from recovery administration. If a single admin path can change both production and backups, the control is too weak.

Decision rule: If suspicious remote access or privileged activity appears near treasury systems, treat it as a payment-integrity incident first and an endpoint incident second. The business question is whether value movement can still be trusted.

Practitioner takeaway: The strongest defence is not simply blocking attackers, it is making every high-value transfer dependent on distinct, observable, and independently controlled approval paths.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?
• How can organisations defend against AI-generated phishing and impersonation?