How can organisations defend against Operation Digital Eye?

How to break the attack chain behind Operation Digital Eye

The direct answer points to a campaign-level defence, so the first task is to map the observed behaviours to control points rather than treating the operation name as the threat. That means hardening privileged access, narrowing external reachability, and watching the stages where phishing, remote access misuse, and suspicious collection usually show up in telemetry and user activity.

For a named campaign, the name is most useful as an investigation anchor: it helps you pivot into email, endpoint, identity, and network data for the same sequence of behaviours rather than searching for a single signature. The defensive value comes from matching the campaign’s access and collection pattern, not from assuming every incident will look identical.

Remote access abuse and data collection are usually easier to contain when organisations reduce overexposed services and make privileged actions more visible. If an attacker can turn one credentialed session into broad access, the campaign can progress quietly even when email security is functioning as expected.

Where organisations should look first

Start with the places most likely to expose the campaign’s entry and expansion path: mail logs, identity logs, remote access records, privileged account activity, and endpoint alerts that show unusual archive, file-access, or exfiltration behaviour. A narrow review of one data source is rarely enough because phishing, login abuse, and collection activity often appear as separate signals.

Validate whether privileged accounts have stronger safeguards than standard users, whether remote access is limited to expected sources and devices, and whether telemetry is complete enough to reconstruct a session. If the detection stack cannot tie a mailbox event to a host process or a remote login to subsequent data access, the campaign can remain visible only in fragments.

The most useful hunting questions are operational ones: which accounts had unusual access after a phishing event, which endpoints generated suspicious outbound activity, and which admin or service sessions touched more data than their normal function requires. Those questions align the investigation to the attack chain instead of to a generic malware search.

How to reduce the chance of repeat compromise

Defence works best when privileged access is treated as a high-risk pathway, not a convenience layer. Tightening admin roles, limiting standing access, and reducing the number of exposed remote entry points all shrink the room an intruder has to pivot after a successful phish or stolen session.

Endpoint and email telemetry matter because the campaign’s detection value depends on correlation. If email filtering catches a lure but endpoint visibility is weak, or if remote access logs exist but are not reviewed with identity activity, the organisation may still miss the full chain of compromise.

In practice, the goal is not to block every message or every login. It is to make the attacker’s path expensive, noisy, and short enough that one suspicious action creates an immediate investigative trail.

Risk and Threat Considerations

Operation-level campaigns are risky because defenders often overfit to the first known indicator and underweight the access pattern that actually enabled the intrusion. If an attacker can combine phishing, privileged access abuse, and data collection, the main exposure is not just initial compromise, it is silent follow-on access to sensitive systems and information.

Failure mechanism: A successful lure or remote access abuse event leads to credentialed access, after which weak privilege boundaries and incomplete telemetry allow the attacker to collect data without triggering a clear containment decision.

Impact: The organisation may lose visibility into who accessed what, face broader data exposure than the initial alert suggested, and spend response time reconstructing the campaign instead of containing it early.

Practitioner Guidance

What to prioritise: Put the most scrutiny on privileged accounts, external-facing access paths, and the telemetry gap between email, endpoint, and identity data. If those three layers are not correlated, you will usually detect fragments rather than the full operation.

What to verify: Confirm that remote access is expected, logged, and attributable; that privileged actions are distinguishable from normal user activity; and that suspicious collection behaviour can be linked back to a host, user, and session. If any one of those cannot be proven, treat the environment as only partially observable.

Practitioner takeaway: The best defence against a named campaign is to force every likely stage of the attack chain to leave evidence, because visibility shortens dwell time even when you do not yet have a perfect indicator.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• How can organisations defend against Operation Triangulation?
• How can organisations defend against Operation Dream Job?
• How can organisations defend against Operation Sharpshooter?
• How can organisations defend against Operation Honeybee?