What tactics and techniques does APT39 use?

How APT39 Operates Across the Intrusion Chain

APT39’s playbook is not just one technique, but a repeatable intrusion chain built around access, persistence and collection. The group blends credential theft, phishing, malware delivery and remote access so it can enter through a plausible user path, then keep using the same access long after initial compromise.

That matters because the threat is not limited to the first click or stolen password. Once an attacker can reuse legitimate accounts, the environment can look normal to controls that rely on simple allow or deny decisions, especially if the compromise happens through mail, remote access or other trusted channels.

For threat-actor context and naming conventions, the Threat Actor Groups Guide helps place APT39 in the wider APT landscape and shows how group intelligence is used across aliases, ATT&CK group IDs and vendor naming schemes.

Initial Access and Foothold Techniques

APT39’s initial access methods are built to blend into ordinary user activity. Credential theft gives it direct reuse of real accounts, while phishing and email compromise create a believable route into inboxes, session tokens and downstream systems. Malware delivery then extends that access into a foothold the group can control.

The practical takeaway is that initial access is often a trust problem before it becomes a malware problem. When the first visible symptom is a successful sign-in or a message sent from a valid mailbox, defenders need to treat those events as potential intrusion indicators rather than routine user activity.

Its phishing-heavy entry path overlaps with the patterns documented in Top 10 Phishing Techniques, especially because mailbox compromise and session theft can let an attacker bypass the normal signs of a malicious attachment.

Post-Compromise Discovery, Lateral Movement and Collection

After foothold establishment, APT39 uses post-compromise discovery to map the environment, identify interesting users and understand where data is likely to live. That is typically followed by lateral movement, often through legitimate accounts, so the group can expand access without relying only on one compromised host.

This is why defenders should pay close attention to unusual internal sign-ins, atypical mailbox access, and movements that do not match the user’s normal role or geography. In many cases, the attacker is not trying to break every control at once; it is trying to use trusted access in a way that avoids obvious alarms.

For adversary-path mapping, the MITRE ATT&CK Enterprise Matrix is the most useful reference for connecting credential access, discovery and lateral movement into a coherent intrusion sequence.

Risk and Threat Considerations

APT39 is dangerous because it turns legitimate access into a stealth mechanism. When stolen credentials, mail access and remote access are all in play, the compromise can persist even if one delivery route is closed, and the attacker can continue operating through trusted identities.

Failure mechanism: A valid account, mailbox or remote access session is abused as an authentication bypass, then used for discovery and lateral movement until defenders notice anomalous use patterns or account activity that no longer fits the user profile.

Impact: The attacker can retain foothold, expand access and collect data while appearing to be an internal user, which increases dwell time and raises the chance of broader exposure across mail, file and network systems.

Practitioner Guidance

What to verify: Check whether suspicious sign-ins line up with impossible travel, new device contexts, unusual mailbox rules, atypical forwarding, or internal logons from accounts that should not be moving laterally. If the account is valid but the behavior is not, treat it as a compromise hypothesis, not a convenience exception.

Decision rule: If an observed event combines credential theft indicators with mailbox access anomalies, prioritize account containment and session invalidation before spending time on host-based cleanup. The most important question is whether the attacker still has reusable access, not whether malware was found on the first affected endpoint.

Practitioner takeaway: For APT39-style operations, the critical control point is not just blocking delivery, but detecting when trusted access starts behaving like attacker infrastructure.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?