What tactics and techniques does APT42 use?

How APT42 Works in Practice

APT42 typically blends low-noise intrusion methods with trust abuse, especially when the target is a person rather than a hardened perimeter. The group’s playbook often starts with believable lures, then uses the resulting trust relationship to collect credentials, capture sessions, or push the victim toward a fake login flow that looks routine enough to avoid immediate suspicion.

That matters because the same technique chain can support both espionage and financial access. Once a user accepts a fabricated prompt, opens a malicious attachment, or follows a lookalike sign-in page, the attacker no longer needs to “break in” in the classic sense; they can operate through the victim’s own authenticated access.

APT42’s method is therefore less about a single exploit and more about sequencing social engineering with credential capture, impersonation, and follow-on access. The practical implication is that defenders should read the campaign as an identity abuse problem as much as a phishing problem, especially when access attempts come from plausible but unusual locations, devices, or message chains.

Common Tactics and Techniques in the APT42 Playbook

Phishing is the most visible entry point, but it is usually only the first step. The lure may be a convincing email, a message chain that mimics a colleague or service desk, or a link to a counterfeit authentication page designed to harvest passwords and MFA prompts. When the attacker can carry the conversation, Top 10 Phishing Techniques is a useful way to understand how session theft, OAuth consent abuse, device-code style prompts, and other modern lures map to real-world compromise paths.

Impersonation is another recurring tactic. APT42 often benefits from pretending to be a trusted sender, service desk contact, partner, or internal stakeholder so the victim is more willing to approve a login, open a document, or reset access. The same social proof can be used to move a conversation across channels, making it harder for defenders to see the full attack chain from one mailbox or one endpoint alone.

Credential theft is the operational goal behind many of these lures. The group commonly aims to obtain passwords, MFA approvals, or other reusable access material, then uses that access to inspect mail, retrieve documents, or pivot to other accounts. For defenders, the important distinction is that the attack may succeed even if malware never lands, because the compromised credential itself becomes the intrusion path.

Delivery can vary depending on the target and the phase of the campaign. Sometimes the attacker uses a direct link to a fake page; in other cases the message chain is designed to keep the victim engaged until the final click, approval, or file open. That variety is why login telemetry, message metadata, and endpoint warnings all need to be reviewed together rather than treated as isolated alerts.

What Defenders Should Watch For

Look first for login anomalies that do not fit the user’s normal pattern. Unfamiliar geographies, unusual device fingerprints, repeated MFA challenges, and short bursts of failed and then successful authentication attempts are all consistent with credential capture or real-time relay. If a user reports a “routine” verification request but the logs show a different browser, device, or source network, treat it as a likely trust-abuse event rather than a simple help-desk issue.

Also watch for lookalike domains, subtle sender spoofing, and message content that pressures the victim to resolve an account problem quickly. These are common indicators that the adversary is trying to push the user into a false sense of urgency before they notice the mismatch. If the page, wording, or approval prompt feels familiar but slightly off, that small difference is often the signal that matters most.

When the activity involves MFA fatigue, repeated prompts, or approval requests that arrive after an unexpected login, assume the attacker is testing whether the victim will normalise the event. A well-run response should correlate the prompt with recent email, chat, or voice contact so analysts can see whether the authentication event was socially engineered rather than purely stolen.

Risk and Threat Considerations

APT42’s blend of social engineering and credential theft creates a high-risk access path because it exploits user trust, not just technical weakness. If a victim authenticates the attacker, the compromise can look legitimate to normal monitoring, which delays detection and expands the time the intruder can read mail, impersonate the user, or move laterally.

Failure mechanism: The attacker induces a user to enter credentials, approve a prompt, or follow a fake authentication flow, then reuses that authenticated access to persist inside the environment while blending into ordinary login behaviour.

Impact: The result can be mailbox compromise, document exposure, impersonation of the victim, and downstream access to additional accounts or sensitive communications that support espionage or financially motivated abuse.

Practitioner Guidance

What to verify: Confirm whether the access event aligns with the user’s normal device, location, and message history before treating it as a routine login issue. If the account is active and the threat path involves a fake sign-in page or stolen session, evidence of successful authentication is more urgent than proving whether malware was delivered.

What to prioritise: Contain the account first, then work outward from the account activity to the email chain, browser session, and any downstream logins. That sequence matters because the attacker may already be using the victim’s legitimate access to reset other credentials or collect sensitive messages.

Practitioner takeaway: For APT42-style activity, the decisive question is usually not “Was malware installed?” but “Did the attacker gain trusted access through the user?”

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?