What tactics and techniques does APT10 use?

How APT10 Gains Access and Establishes Footholds

APT10’s playbook is built around initial access that looks routine enough to blend into normal enterprise activity. Phishing and credential theft create the entry point, then web shells or legitimate administration tools let the operator establish a durable foothold without immediately standing out. That combination matters because the early stage is often less about a single exploit than about abusing trusted access paths.

Once an attacker has valid credentials or a foothold on a reachable host, the environment can start to look like ordinary administration rather than intrusion. That is why defenders need to separate normal remote management from activity that is authenticated but inconsistent with the user, host, timing, or process history.

How APT10 Moves, Persists, and Reaches Data

After entry, APT10 commonly uses lateral movement, persistence, and living-off-the-land tooling to expand access and avoid easy detection. Living-off-the-land is especially important because it reduces the need for noisy malware and lets the actor operate through tools that are already present and often trusted by defenders.

Data collection and exfiltration usually come later in the chain, after the operator has identified valuable systems and established enough access to move around credibly. In practice, that means the same host may show signs of reconnaissance, remote administration, and file access before the actual theft becomes obvious.

For a broader view of how these attack chains are tracked, MITRE ATT&CK Enterprise Matrix is the best external reference for mapping the tactics behind credential access, lateral movement, persistence, and exfiltration.

What Defenders Should Watch For in an APT10-Style Intrusion

The most useful detection angle is not any single tool name, but the pattern: suspicious remote administration, unusual process execution, and authenticated access that does not fit normal administrator behaviour. APT10-style activity often becomes visible when a login is valid but the resulting commands, child processes, or access sequence are not normal for that account or that system.

Teams should also look for the gap between first access and later-stage activity. Phishing, web shell use, and credential abuse may be separated from lateral movement and exfiltration by days or longer, so short detection windows tend to miss the full intrusion path.

For hunt planning, MITRE D3FEND helps translate those observed behaviours into defensive countermeasures, while Threat Actor Groups Guide helps place APT10 in the broader threat-actor context and compare it with other APT campaigns.

Risk and Threat Considerations

APT10 is dangerous because it combines trusted access with stealthy follow-on activity. Once valid credentials, a web shell, or a legitimate admin tool is in play, the boundary between authorised administration and malicious operations becomes much harder to see, especially in large environments with many remote management paths.

Failure mechanism: The attacker abuses a trusted credential or host, then uses routine administrative tooling and process chains to move laterally, persist, and collect data without triggering obvious exploit signatures.

Impact: Organisations may miss the intrusion until the actor has already expanded access, gathered sensitive data, or prepared for repeated re-entry through a durable foothold.

Practitioner Guidance

What to verify: Confirm whether administrator accounts, service accounts, and remote management hosts are producing commands and process trees that match their usual baseline. A valid login is not reassuring if the post-login behaviour is atypical.

Decision rule: If you see authenticated access plus web shell behaviour, unusual remote execution, or a sudden jump in lateral movement, treat the case as a probable intrusion path rather than an isolated alert. Prioritise containment and credential review before relying on endpoint cleanliness alone.

Practitioner takeaway: The key judgement is to hunt for the sequence, not the individual event, because APT10’s strength is making one compromise look like normal administration until the intrusion is already well established.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?