What tactics and techniques does APT6 use?

How APT6 Operates Across Intrusion and Post-Compromise Phases

APT6 is best understood as a threat actor group that mixes initial access, persistence and post-compromise activity rather than relying on a single repeatable exploit path. The practical question is less “what one trick does it use?” and more “which intrusion stage is it in right now, and what evidence would show that the operation has moved from access into control?”

That matters because the same actor may use different entry methods against different targets, then quickly shift to credential theft, remote execution and collection once it has a foothold. For defenders, the early-stage signals are usually less important than the sequence: initial lure or service abuse, followed by authenticated activity, lateral movement and outward data staging.

APT6’s technique set therefore sits in the familiar attacker workflow of initial access, execution, persistence, privilege use and collection. A useful way to read the group is as an operator of chained techniques, where one small success, such as a valid login or a remotely reachable service, can be turned into broader internal access.

What to Look for in Phishing, Service Abuse and Credential Theft

The most visible entry patterns are phishing and abuse of exposed services, both of which can give the actor a first authenticated step into the environment. Those techniques become much more dangerous when they are paired with stolen credentials, because a compromised account often looks like ordinary user or admin activity until the pattern is compared with device, network and mailbox history.

A good source of comparison is Top 10 Phishing Techniques, which helps security teams distinguish common lure patterns from the credential-theft outcomes that often follow them. Once credential material is in play, the investigation should move beyond the phishing event itself and ask which accounts, sessions or tokens were exposed and how far they can reach.

Exposure through services is just as important as lure-based entry. If an externally reachable system is abused, the issue is often not the original service alone but the fact that it can be used as a bridge into internal systems, scheduled tasks or administrative interfaces without triggering the same controls that would stop a direct interactive attack.

Why Lateral Movement, Remote Execution and Data Collection Matter

After entry, the actor’s objective usually shifts to operational control. Remote execution, reuse of authenticated access and lateral movement allow it to blend in with normal administration while it expands reach to endpoints, file shares, mail systems or management tooling. That is the stage where a limited intrusion becomes a broader compromise.

For a technique-level view of the offensive chain, the MITRE ATT&CK Enterprise Matrix is the most useful public reference because it organises attacker behaviour by tactic, including credential access, lateral movement and command-and-control. The point for defenders is not just to name the tactics, but to correlate them across logs so that one suspicious event is not treated as an isolated anomaly.

Collection is the natural end state of this workflow. Once the actor can move laterally and execute commands, it can gather files, email, host data or other internal material, then stage that data for exfiltration. At that point, the most informative questions are which hosts communicated outward unexpectedly, which accounts touched unusual resources, and whether the same actor reused access paths across multiple systems.

Risk and Threat Considerations

APT6-style operations are risky because each successful step lowers the cost of the next one. A phished account, an exposed service or a reused credential can quickly become a foothold for persistence, internal movement and data access, especially when logging is fragmented across email, endpoint and network layers.

Failure mechanism: The attack chain works when initial access is converted into trusted internal activity before defenders connect the signals, especially where valid credentials, remote execution and outbound communications are monitored separately.

Impact: The likely outcome is broader compromise of accounts and systems, followed by collection or exfiltration of sensitive data and a longer dwell time that makes containment harder.

Practitioner Guidance

What to verify: Confirm whether suspicious logins, remote commands and outbound connections line up for the same host or account. If they do, treat the event as a coordinated intrusion path rather than a set of unrelated alerts.

Decision rule: If the activity involves a valid account, prioritise credential, session and endpoint review before assuming the intrusion is only a malware problem. If the activity involves an exposed service, verify whether it was a direct entry point or only one stage in a broader chain.

Practitioner takeaway: The key judgement is to reconstruct the attacker’s sequence, not just catalogue the tools used, because the operational risk comes from how quickly access turns into persistence, movement and collection.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?