What tactics and techniques does APT38 use?

What APT38’s tradecraft looks like in practice

APT38 is not a spray-and-pray intrusion set. Its activity is shaped around bank fraud, payment disruption, and direct monetisation, so the group tends to combine initial access, privilege expansion, and transaction manipulation in one campaign flow. That matters because the objective is usually not just access, but controlled access to financial workflows.

Its most visible techniques sit at the intersection of social engineering and post-compromise control. Spearphishing is often used to gain the first foothold, then credential abuse and remote access are used to move into higher-value systems where payment processing, treasury activity, or transaction approval can be influenced.

Defenders should read those techniques as a sequence, not isolated events. The group’s value comes from persistence inside the environment long enough to understand how payment systems are operated, where approvals occur, and which accounts can alter or observe transactions without immediate detection.

How APT38 turns access into financial theft

Once inside, the group commonly focuses on lateral movement and workflow manipulation. That can include pivoting from a user system into administrative or server-side environments, then using legitimate tools and stolen credentials to reach systems that process or authorise financial activity. The abuse often looks operationally normal until the transaction outcome is inspected.

This is why the payment environment itself is a target. APT38 does not need to create a new banking process if it can alter an existing one, delay a transfer, change a beneficiary, or exploit weak segregation between user access, privileged access, and payment execution. In practice, the technique is as much about control of business logic as it is about malware or shell access.

MITRE ATT&CK Enterprise Matrix is useful here because APT38-style activity maps cleanly to credential access, lateral movement, and collection or impact behaviours that defenders can hunt for in sequence.

What defenders should watch for in payment-focused intrusions

In a campaign like this, the highest-signal detections are usually not one-off alerts but combinations: unusual remote desktop use, privileged logons outside the normal operating window, account use that does not match job function, and financial transactions that diverge from established patterns. Those combinations are often more informative than any single indicator.

Segregation is the practical control theme. If payment systems, admin workstations, approval channels, and fraud-monitoring paths are not separated, an attacker can collapse the trust boundaries and reuse one compromise to influence multiple stages of the payment lifecycle. Recovery also matters, because fraud defence is not just containment, it is the ability to validate and reverse affected transactions quickly.

Threat Actor Groups Guide helps place APT38 in the broader actor-categorisation context, including how group naming, aliases, and threat-intelligence interpretation affect investigation.

Risk and Threat Considerations

APT38-style activity is dangerous because it blends identity abuse with business-process abuse. Once an attacker can authenticate as a legitimate user or administrator, the environment may still appear normal while the financial workflow is already compromised.

Failure mechanism: Spearphishing or credential theft gives the intruder a legitimate access path, then lateral movement and privileged action let the attacker reach payment or transaction systems where changes are hard to distinguish from authorised activity.

Impact: The likely result is fraudulent transfers, payment tampering, delayed detection, and a larger recovery burden because the attacker is targeting operational financial processes rather than only technical infrastructure.

Practitioner Guidance

What to prioritise: Treat payment-system monitoring, privileged access review, and remote-access scrutiny as a single detection problem. If those controls are separate, the attacker can hide in the gap between them.

What to verify: Confirm that transaction approval paths, admin access, and fraud review are segregated enough that one compromised account cannot both initiate and legitimise a payment.

Common mistake: Focusing only on malware removal after intrusion. With APT38, the operational question is often whether any transaction logic, approval state, or beneficiary detail was changed while access was still live.

Practitioner takeaway: For financially motivated intrusion sets, the real defensive objective is not just blocking entry, it is preserving trustworthy payment state, because that is where the theft is usually monetised.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?