Daggerfly uses phishing, malicious installers, and custom malware to gain footholds in targeted environments. It is associated with espionage, credential theft, and persistence mechanisms that help it stay resident after detection attempts. Defenders should look for deceptive email content, unsigned or unexpected binaries, and unusual process or network behaviour on endpoints.
How Daggerfly gets in and stays in
Daggerfly combines initial access through phishing with execution paths that rely on malicious installers and custom malware. That mix matters because it lets the actor move from a believable delivery vector into code execution, then into persistence mechanisms designed to survive cleanup. The practical question is not just whether an endpoint was touched, but whether the intrusion path created durable footholds.
Phishing is the entry point that makes the rest possible, while the installer and payload stages convert user interaction into a controlled execution chain. Once the foothold exists, persistence is the defensive challenge: if resident components are left behind, a one-time alert can become an ongoing access problem.
For group-level context, the Threat Actor Groups Guide is useful when you are trying to place Daggerfly within broader threat intelligence, naming, and campaign-tracking workflows.
What the malware and post-compromise activity are trying to achieve
The direct answer points to espionage, credential theft, and persistence, which is a strong indicator that the campaign is not just about opportunistic disruption. Espionage typically means quiet collection and longer dwell time, credential theft expands access beyond the initial host, and persistence preserves the actor’s ability to return even after partial remediation. Those goals shape how defenders prioritise investigation.
Because credential theft is part of the picture, the likely consequence is broader than a single compromised machine. Stolen credentials can support lateral movement, repeated logins, or access to shared services that were never intended to be reachable from the original infection point. Persistence then turns that stolen access into a standing risk if accounts, sessions, or endpoint trust are not reset.
The MITRE ATT&CK Enterprise Matrix is a good external reference for mapping those behaviours to credential access, persistence, and post-compromise tradecraft.
The MITRE D3FEND knowledge graph is also helpful when translating those observed techniques into concrete defensive countermeasures and hunt logic.
What defenders should look for on endpoints and in telemetry
The indicators in the answer are operationally useful because they describe what the actor needs to do at the endpoint: deliver deceptive email content, run unsigned or unexpected binaries, and generate unusual process or network behaviour. Those are not generic red flags, they are the behaviours that usually expose the transition from initial delivery to active compromise.
In practice, defenders should correlate email, process, and network telemetry rather than treating each signal in isolation. A suspicious message that precedes a new binary launch, followed by unusual child processes or outbound connections, is much more actionable than any one event on its own. That sequence helps distinguish a nuisance delivery from a real foothold.
Use the Top 10 Phishing Techniques to sanity-check the delivery side when you are triaging deceptive email campaigns and lure patterns.
Decision rule: If the binary is unsigned, unexpectedly installed, or launched from a user path that normally should not execute code, treat it as a likely compromise path and investigate parent-child process chains before focusing only on the file hash.
What to verify: Confirm whether the suspicious activity is isolated to one endpoint or repeated across multiple hosts, because repeated delivery patterns often indicate a campaign rather than a single-user mistake.
Practitioner takeaway: The highest-value response is to reconstruct the full chain from lure to execution to persistence, because Daggerfly-style activity is only fully understood when the delivery mechanism and the resident foothold are analysed together.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Daggerfly uses phishing as an initial access technique. |
| T1547 — Boot or Logon Autostart Execution | Persistence mechanisms are central to the answer and align to autostart-style persistence. | |
| T1059 — Command and Scripting Interpreter | Custom malware typically relies on script or interpreter-driven execution after foothold. | |
| Recommendation — Map lure activity to T1566 and hunt for delivery, click, and execution traces. Search for autostart persistence and remove any surviving launch points. Inspect script execution and process ancestry for malicious staging activity. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org