What tactics and techniques does GCMAN use?

How GCMAN’s playbook usually starts

GCMAN is best understood as a phishing-led intrusion set: it uses email-based lures to get a foothold, then relies on user action to open the door for the next stage. That means the early chain is usually less about novel exploitation and more about convincing a target to trust a message, file, or link long enough for malware delivery to succeed. The Top 10 Phishing Techniques page is a useful companion for understanding how lure design, attachment abuse, and link-based delivery patterns show up in real campaigns.

In practical terms, the first phase is about access generation, not persistence. A successful lure gives the operator an initial execution path, often through a document, script, or dropper that runs after the victim interacts with it. That matters because the defensive focus should stay on the handoff from email to endpoint, where credential capture, malware launch, and session abuse most often begin.

What happens after the initial lure succeeds

Once inside, GCMAN techniques typically shift toward establishing control, moving laterally, and reaching systems tied to banking or finance operations. The direct answer points to malware delivery, credential theft, remote access tooling, and unusual outbound traffic, which together suggest a campaign that uses the victim environment against itself after the first compromise. This is the stage where attacker activity becomes more visible in endpoint telemetry, authentication logs, and network flows.

The pattern is consistent with a hands-on intrusion chain: collect credentials, expand access, and blend into normal administrative or user activity. Lateral movement is especially important because it turns a single compromised mailbox or workstation into access across additional hosts, shares, or internal services. Outbound traffic anomalies often appear after the victim has already interacted with the lure, so the timing of the connection is often as important as the destination.

For attack-chain mapping, the MITRE ATT&CK Enterprise Matrix is the clearest external reference for understanding how phishing, credential access, lateral movement, and remote tooling fit together in one intrusion sequence.

Which techniques defenders should expect to see together

The tactics described here do not usually appear in isolation. Spearphishing often pairs with malicious attachments or links, then hands off to script execution, downloader behavior, or remote access tools that create a more durable foothold. Credential theft is significant because it can convert a user-driven intrusion into something that looks like legitimate access, which makes detection harder and response slower.

That combination also explains why banking-targeted campaigns often generate noise that looks operational rather than malicious. Remote access tooling can resemble support activity, and outbound traffic may be dismissed if the destination is not obviously hostile. Defenders should therefore treat the sequence, order, and correlation of events as more important than any single indicator in isolation.

For example, email delivery followed by script execution and then a new outbound connection from the same host is much more meaningful than any one event alone. The same is true when a user account suddenly authenticates from a host that just opened an attachment or launched a script. In that sense, the campaign is less about one exploit and more about chaining ordinary behaviors into a compromise path.

Risk and Threat Considerations

Phishing-led intrusion sets are dangerous because they exploit normal business trust relationships, especially the expectation that email, attachments, and internal remote-access tools are safe enough to use quickly. Once credentials or execution are obtained, the attacker can pivot from one compromised user to broader internal access with relatively low friction.

Failure mechanism: User interaction with a lure enables malware execution or credential capture, which then supports lateral movement, remote access, and additional compromise across the environment.

Impact: The result can be mailbox takeover, broader credential exposure, unauthorized internal access, and escalation toward financial systems or other high-value targets, often before the intrusion is recognized.

Practitioner Guidance

What to verify: Correlate email delivery, attachment or link interaction, process execution, authentication events, and outbound network connections on the same endpoint. A single alert is weaker evidence than a sequence that shows user click, code execution, and follow-on network activity.

Decision rule: If you see credential theft indicators or remote access tooling after a lure was opened, treat the host and account as potentially compromised rather than waiting for a second confirmation. The safe assumption is that the attacker may already have what they need to move laterally.

What practitioners underestimate: The most useful signal is often the transition from user interaction to machine activity, not the lure itself. Teams that focus only on malicious email content can miss the later-stage signs that show the intrusion has already progressed beyond delivery.

Practitioner takeaway: The key defensive question is not whether a phishing email arrived, but whether it produced executable activity, credential exposure, or lateral movement before containment began.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?