What tactics and techniques does APT18 use?

How APT18 operates across the intrusion chain

APT18 is best understood as a campaign-driven actor that combines initial access, post-compromise discovery, and persistence rather than relying on a single technique. The tactics in the question line up into a practical sequence: lure or exploit, implant, steal credentials, map the environment, then hold access long enough to collect data without drawing attention.

That pattern matters because it means defenders should not look only for the first malicious email or exploit attempt. The more useful question is whether the intrusion progressed into privilege reuse, internal reconnaissance, and mechanisms that keep the attacker present after the initial compromise.

APT18 also fits the broader threat-actor-group model used to track repeatable behaviour across operations. For teams building a response playbook, that means the actor name is less important than the recurring intrusion pattern and the controls that interrupt it at each stage, as described in the Threat Actor Groups Guide.

What the initial access and persistence techniques usually look like

The initial phase is typically designed to get code execution or a foothold on a target endpoint or exposed service. Spearphishing, exploit delivery, and malware implants are not interchangeable, but they all serve the same purpose: create an entry point that can be used for follow-on activity. In practice, that means defenders should expect both user-driven compromise paths and direct exploitation paths to appear in the same intrusion set.

Once inside, persistence is the part that turns a one-time compromise into a lasting operation. Scheduled tasks, services, startup items, registry changes, and similar mechanisms are attractive because they survive reboots and give the actor a predictable way back in. If persistence is not removed, remediation often becomes temporary even when the original payload is gone.

For email-led delivery chains, the useful lens is to separate the lure from the payload. Phishing often succeeds because the attachment, link, or follow-on macro is only the first step, and the real damage comes when the victim system is used to stage the next layer. NHIMG’s Top 10 Phishing Techniques is a practical companion for understanding how those delivery patterns commonly work.

Why credential theft and internal discovery make the intrusion more dangerous

After initial access, credential theft changes the attacker’s reach from one endpoint to the broader environment. Stolen credentials let the actor blend in with normal administrative activity, expand to file shares or servers, and avoid noisy exploit activity once they have valid access. That is why suspicious administrative actions often matter more than the original delivery mechanism.

Internal discovery is the other key escalation step. Once the attacker can enumerate hosts, users, groups, shares, and trust relationships, the intrusion becomes a search problem: identify where valuable data sits, which systems are monitored, and which paths lead to better privileges or persistence. Discovery is often quiet, but it is one of the clearest signs that the intrusion is moving from access to objective.

Risk and Threat Considerations

APT18-style activity is risky because the same intrusion can move from user compromise to enterprise-wide access without a dramatic change in tooling. The combination of stolen credentials, administrative misuse, and long-lived persistence makes containment harder and increases the chance of data collection before the attack is detected.

Failure mechanism: Defenders focus on the initial phishing or exploit event, but miss the later abuse of valid accounts, scheduled tasks, and discovery commands that preserve access and widen the blast radius.

Impact: The attacker can remain embedded long enough to exfiltrate data, return after partial cleanup, and operate through accounts that look legitimate in logs.

Practitioner Guidance

What to verify: Treat any successful initial access event as incomplete until you have checked for credential theft, unusual local or domain admin activity, new persistence mechanisms, and signs of lateral discovery. If those follow-on behaviours are present, the incident should be handled as a broader compromise, not a single endpoint problem.

Decision rule: If the intrusion includes valid-account use or scheduled-task persistence, prioritise credential reset, session invalidation, and host isolation before assuming the malware cleanup is sufficient. If you only remove the payload, the attacker may still retain access through stolen credentials or a secondary foothold.

Practitioner takeaway: The key judgement is to investigate the intrusion chain, not just the first alert, because APT18-style operations become materially more dangerous after the attacker acquires valid access and persistence.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?