What tactics and techniques does Andariel use?

How Andariel’s tradecraft typically unfolds

Andariel’s techniques fit a familiar intrusion chain: initial access, follow-on execution, credential abuse, internal movement, and exfiltration. The group’s use of spearphishing and exploit-based intrusion means defenders should treat the first signs of compromise as potentially staged rather than isolated, because the objective is often to convert one successful entry into broader access across the environment.

Custom malware matters because it usually serves more than one role at once. It can deliver payloads, maintain access, collect system information, and enable operator actions that are harder to attribute than commodity tooling. When custom tooling appears alongside suspicious authentication activity or remote service creation, the likely concern is not just malware presence, but an active attempt to build a usable foothold.

For a broader threat-actor taxonomy and campaign context, use the Threat Actor Groups Guide to place Andariel in the wider landscape of group naming, aliases, and ATT&CK-style attribution.

What the post-compromise techniques are designed to achieve

Credential theft is typically the pivot point. Once an attacker obtains valid credentials, the intrusion starts to look like normal administrative activity unless defenders correlate logons, session patterns, and privilege changes. That is why unusual authentication patterns are such a useful signal: they often reveal abuse of legitimate access rather than a noisy exploit still in progress.

Lateral movement and tool transfer are the next major milestones. Remote service creation, remote execution, and discovery activity are common ways to move from one host to another while blending into management traffic. In practical terms, this means defenders should look for the combination of a successful access event, followed by administrative-style execution, followed by staged collection or data movement.

Andariel’s phishing-heavy entry path aligns with the broader phishing playbook described in Top 10 Phishing Techniques, especially where attachments, lures, or user interaction are used to initiate the compromise chain.

Why defender visibility has to follow the intrusion chain

The useful detection question is not simply whether a malicious file landed, but whether the environment shows a sequence of behaviours that match attacker intent. Attachment delivery, suspicious execution, anomalous authentication, new remote services, and endpoint discovery activity become far more meaningful when they line up in time. That correlation is what separates a blocked phish from a living intrusion.

Data theft is often the final objective, so endpoint and identity telemetry should be reviewed together. If a system shows discovery commands, unusual archive creation, or outbound transfer after credential abuse, assume the actor has moved beyond testing access and is operationally exploiting it. At that point, containment should focus on stopping the session path as well as the infected host.

Risk and Threat Considerations

Andariel’s combination of phishing, exploit delivery, credential theft, and lateral movement creates a risk profile where one weak control can quickly become an enterprise-wide incident. The main danger is that valid credentials and remote administration paths can make hostile activity look routine until the attacker has already expanded access.

Failure mechanism: A successful initial compromise is converted into legitimate-looking internal access through stolen credentials, remote services, and endpoint tooling, which weakens normal detection based on simple malware blocking.

Impact: The result can be broader host compromise, privilege escalation, and theft of sensitive data before defenders identify the intrusion chain.

Practitioner Guidance

What to verify: Correlate mail gateway events, endpoint execution, authentication logs, and remote service creation around the same time window. The key judgment is whether the compromise is isolated to a single endpoint or already using valid access to move laterally.

What to prioritise: If you see credential theft or suspicious remote services, treat credential reset and session invalidation as immediate containment steps, not follow-up hygiene. Malware removal alone is insufficient if the actor still has usable access paths.

Practitioner takeaway: The most important judgment is to treat Andariel-style activity as an intrusion chain, not a single event, because the real damage usually comes after the first foothold is converted into authenticated internal access.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?