Organisations can defend against Threat Group-3390 by securing remote access, patching exposed systems, and watching for post-compromise activity. Use MFA, minimise privileged accounts, and monitor for suspicious logons, web shell placement, credential theft, and lateral movement. Segment sensitive environments and preserve logs from both identity and endpoint layers for investigation.
What Threat Group-3390 defence should be built around
Defence should be organised around the intrusion chain that this group typically uses: initial access through exposed remote services, then credential theft, privilege abuse, web shell deployment, and internal movement. The practical aim is to make each step harder, more visible, and faster to contain, rather than relying on a single perimeter control.
That means focusing on remote access hygiene, patch discipline for internet-facing systems, strong authentication, and strict separation between user, admin, and sensitive zones. It also means treating endpoint telemetry and identity logs as first-class evidence, because post-compromise activity often matters more than the initial access path once an intrusion is underway.
When you map the attack chain to defence, the useful question is whether the organisation can detect the first abnormal remote login, stop privilege escalation, and prevent a compromised foothold from reaching crown-jewel systems. If any of those three fail, the group’s value comes from speed and repetition, not from a single novel exploit.
How to reduce the blast radius of remote-access compromise
Remote access should be the first hardening priority because exposed gateways, VPNs, and externally reachable management surfaces are the easiest way for an attacker to turn a weak edge system into a beachhead. Use phishing-resistant MFA where possible, remove unnecessary exposed services, and keep privileged access off the same pathways that ordinary users depend on.
Privileged accounts should be minimised and tightly separated from daily-use identities. Short-lived access, explicit approvals, and environment-specific admin paths reduce the chance that a stolen credential or session can be reused broadly. If remote administration is unavoidable, segment it and monitor it separately so that suspicious use stands out instead of blending into normal traffic.
Patch management matters most where the system is reachable from the internet or exposed to external partners. The operational rule is simple: if the system can be touched from outside, treat delay in patching as a material exposure, not a routine backlog item.
What to look for after initial access
Once an attacker has a foothold, the most important indicators are often behavioural rather than signature-based. Look for unusual logon geography or timing, abnormal privilege use, new web shells, suspicious service creation, unexpected scripting activity, and lateral movement that does not match the user or host’s normal role.
Identity telemetry should be correlated with endpoint activity, because a valid sign-in can still be the beginning of compromise. Web shell placement, token abuse, credential dumping, and remote execution are all signs that the incident has moved beyond initial access and into persistence or expansion. Preserving logs from both the identity layer and the endpoint layer is essential because either one alone can leave the investigation incomplete.
Threat Actor Groups Guide is useful when teams need to translate an attribution label into an operational picture of aliases, group naming, and campaign context. The broader pattern is that group intelligence helps you recognise likely techniques, but it should not replace direct telemetry from your own environment.
Risk and Threat Considerations
Threat Group-3390 style activity is dangerous because it combines access abuse with persistence. Once a valid account, exposed service, or compromised host is in play, attackers can move from entry to internal discovery quickly, and many of the resulting actions look like legitimate administration until the damage is already spreading.
Failure mechanism: Weak remote access, stale exposure, or overprivileged accounts let the attacker establish a foothold, then reuse stolen credentials or sessions to expand access and evade simple perimeter controls.
Impact: The likely consequence is broader domain or environment compromise, with risk to sensitive systems, credentials, and investigation quality if logs are incomplete or overwritten.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | Threat Group-3390 defence centres on stolen and abused credentials for access persistence. |
| T1021 — Remote Services | The group’s likely initial access and movement path includes exposed remote access services. | |
| T1059 — Command and Scripting Interpreter | Post-compromise activity often uses scripting and remote command execution for expansion. | |
| Recommendation — Hunt for valid-account use that bypasses normal authentication patterns and revoke compromised access quickly. Monitor and restrict remote services used for interactive access into internal systems. Detect unusual scripting and remote execution on servers and workstations. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Minimising privilege and controlling access paths directly reduces the group’s blast radius. |
| CIS-8 — Audit Log Management | Identity and endpoint logs are needed to detect and investigate post-compromise activity. | |
| Recommendation — Remove unnecessary privileges and tightly govern privileged access paths. Centralise and retain authentication and endpoint logs for threat hunting and investigation. | ||
Practitioner Guidance
What to prioritise: Start with the externally reachable systems and the identities that can reach them. If those two layers are hardened and monitored well, the group’s opportunities narrow sharply before deeper containment work begins.
What to verify: Confirm that remote access is covered by MFA, that privileged accounts are limited to named administrators, and that identity, VPN, gateway, and endpoint logs are retained long enough to reconstruct a full intrusion timeline.
Decision rule: If you find a suspicious remote login or a web shell on an internet-facing host, treat it as a likely compromise path, rotate exposed credentials where relevant, and hunt for lateral movement before declaring the event contained.
Practitioner takeaway: The most effective defence is not just blocking entry, it is making every post-access step costly, observable, and containable so a single foothold cannot become a full compromise.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org