What tactics and techniques does APT-C-36 use?

How APT-C-36 typically gets initial access

APT-C-36 relies on social engineering first, then turns that access into credential theft. Its common entry paths include phishing lures, lookalike login pages, and malicious attachments that prompt a user to hand over passwords or execute content. The practical implication is that the campaign often looks more like a trust abuse operation than a noisy exploit chain.

That matters because defenders should evaluate the lure, the destination page, and the credential capture step as one sequence. When a phishing message impersonates a brand or a payroll or account-recovery workflow, the attacker is trying to create a normal-looking path into an account before any traditional malware signal appears.

What APT-C-36 is trying to achieve after the first click

The observed tactics point to account compromise, session abuse, and follow-on access to systems that trust those accounts. Once credentials are stolen, an attacker can attempt mailbox access, payroll fraud, account recovery abuse, or further intrusion using legitimate sign-in paths rather than overt exploit activity. That is why authentication anomalies and unusual login behavior are part of the detection picture.

Top 10 Phishing Techniques is a useful companion because it breaks down the lure patterns that commonly drive credential theft, including link-based deception and attachment-based delivery. MITRE ATT&CK Enterprise Matrix is the right external reference for mapping those behaviors to credential access, phishing, and downstream movement techniques. Microsoft Midnight Blizzard breach is also relevant as a comparison point for how stolen or weakly protected logins can be abused to turn an initial access weakness into broader compromise.

What defenders should hunt for in an APT-C-36 style campaign

The most useful hunt signals are brand impersonation, fake authentication flows, and traffic that leads users to credential-harvesting infrastructure. On the endpoint and in identity telemetry, look for sign-ins that do not match the user’s normal geography, device, or timing, especially when they follow a suspicious email or a prompt to recover an account. In mailbox and proxy logs, the suspicious part is often the path, not just the payload.

Watch for attachments that trigger unexpected external requests, newly registered or lookalike domains, and repeated login attempts from unfamiliar IP space after a lure is delivered. If the campaign succeeds, the follow-on activity often includes mailbox rule abuse, changes to recovery settings, and attempts to pivot into payroll or finance workflows where stolen credentials can be monetized quickly.

Risk and Threat Considerations

APT-C-36-style activity is risky because it uses familiar business processes against the user, which can make the compromise look routine until the account is already exposed. The combination of phishing, fake login pages, and credential theft creates a low-friction path to account takeover, and the attacker can often blend into ordinary authentication traffic once the password is captured.

Failure mechanism: The attack succeeds when a user trusts an impersonated brand or recovery flow, submits credentials into an attacker-controlled page, or opens a malicious attachment that leads to credential capture or session theft.

Impact: The result can be account compromise, mailbox access, fraud against payroll or finance processes, and secondary intrusion through any system that trusts the stolen identity.

Practitioner Guidance

What to verify: Confirm whether suspicious messages led to a login page, whether that page matched a known brand or identity provider, and whether any successful sign-ins occurred immediately after the lure. Correlate email telemetry, web proxy logs, and authentication logs rather than treating each signal in isolation.

Decision rule: If you see a phishing lure plus an anomalous authentication event, treat it as a potential compromise even when malware is absent. If the affected account can approve recovery, payroll, or inbox delegation actions, prioritize containment before deeper triage.

Practitioner takeaway: The key judgement is to investigate the trust chain, not just the message, because APT-C-36 wins when a believable workflow turns into a legitimate-looking login and then into usable access.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques does APT-C-23 use?
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?