What tactics and techniques does APT22 use?

How APT22’s tradecraft typically unfolds

APT22 is best understood as an espionage-focused actor that blends initial access, persistence and quiet collection rather than one single hallmark technique. In practice, the tradecraft usually starts with phishing techniques that deliver malware or credentials, then shifts into controlled execution, internal discovery and carefully paced exfiltration. Defenders should expect the activity to look like a sequence of ordinary-seeming events until the pieces are correlated.

The important analytic point is that the campaign is rarely visible from one alert alone. A spear-phishing message, a successful logon, a remote access session and an archive being staged for transfer may each look benign in isolation. The tactic becomes meaningful when you connect those events to the same user, host and time window, then compare them to normal access patterns for that environment.

APT22’s use of malware execution and follow-on operator activity means you should not treat the initial payload as the whole intrusion. Once code is running, attackers often shift to discovery, credential access and movement between systems, because that is how they turn a single foothold into broader access. The real risk is the combination of access path plus stealth, not any one technique by itself.

Why lateral movement and stealth matter in this intrusion pattern

After initial compromise, the activity often expands through lateral movement, privilege use and quieter forms of collection. That makes network-only detection incomplete. For this kind of actor, the more valuable signals are unusual remote access, repeated authentication attempts, remote administration from atypical sources and archive creation or transfer behaviour that does not fit the user’s role.

Stealth is not just about hiding malware. It is also about reducing visible friction while the operator works, for example by reusing trusted tools, blending into normal administration paths, or using legitimate sessions to move data. That is why identity telemetry matters alongside endpoint telemetry, especially where remote access, token misuse or credential theft may have enabled the session.

Because APT22 is associated with espionage-style objectives, the downstream objective is usually information theft rather than immediate disruption. That changes what analysts should prioritise. The question is not only whether the endpoint is clean, but whether the actor has already established enough access to browse mailboxes, file shares, cloud content or internal repositories without being noticed.

The best analogue is a low-noise intrusion chain: initial access, credential use, internal expansion and careful collection. MITRE ATT&CK Enterprise Matrix is useful here because it helps map those behaviours to tactics such as credential access, lateral movement and exfiltration so teams can reason about the attack as a chain, not a single event.

What defenders should verify before calling it contained

Containment should not be declared simply because the original phishing email was removed or one host was reimaged. Practitioners should verify whether the same user, device or session was used to access additional internal resources, whether credential material was exposed, and whether any suspicious archive, compression or transfer activity followed the initial compromise.

That verification step should include mail, endpoint, VPN, SSO and privileged access logs where available. If the actor used a stolen session or password, the initial malware may be gone while the access path remains valid. If the actor created archives or staged files for transfer, the objective may already have shifted to theft, meaning forensic review has to look backward as well as forward.

When the intrusion path includes identity abuse, it helps to trace the activity back to a specific account and session rather than a generic machine alert. That makes it easier to decide whether to rotate credentials, invalidate sessions, or review adjacent systems that may have been accessed from the same trust relationship. APT22-style activity is exactly the sort of case where a single compromised user can become a pivot into a wider environment.

Use the Threat Actor Groups Guide to place APT22 in the wider actor-group context, especially when you need to compare its tradecraft with other APT campaigns and naming conventions. That helps analysts avoid treating the label as enough evidence on its own.

Risk and Threat Considerations

This pattern is risky because espionage actors optimise for quiet persistence and selective exfiltration, which means compromise can continue after the most obvious indicators have been removed. The main danger is not just that one device is infected, but that trusted credentials or active sessions let the actor keep collecting without triggering obvious intrusion alarms.

Failure mechanism: Phishing or malware creates a foothold, then stolen credentials, valid sessions or internal trust relationships let the operator move laterally and gather data with minimal noise.

Impact: Sensitive mail, files, credentials or internal documents can be exposed, and defenders may discover the intrusion only after data has already been staged or removed.

Practitioner Guidance

What to verify: Confirm whether the suspicious activity ties to one user, one host or one session, then check whether that identity touched mail, file shares, remote access or admin paths outside its normal pattern. If you cannot establish that linkage, assume the intrusion may be broader than the first alert suggests.

Decision rule: If the evidence includes credential theft, unusual remote access or archive staging, prioritise session invalidation and credential review before spending time on perfect host-level cleanup. If the actor is still authenticated somewhere, reimaging one machine will not end the risk.

Practitioner takeaway: For APT22-style activity, the decisive question is whether the attacker still has a usable path into the environment, because stealthy collection often outlives the original malware.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?