What tactics and techniques does Higaisa use?

How Higaisa Typically Gets Initial Access

Higaisa’s early-stage tradecraft is built around user interaction rather than direct exploitation. That usually means socially engineered email delivery, weaponised attachments, and staged payloads that only reveal their full behaviour after a target opens the document or enables the content it needs. For defenders, the key question is less “did the attachment arrive?” and more “did anything execute, reach out, or spawn a second stage after the user interaction?”

That pattern matters because it creates a narrow but important detection window. A malicious document may look ordinary until macros, embedded objects, or follow-on scripts activate. The delivery method is often designed to avoid noisy intrusion signatures, so initial compromise can blend into normal inbox traffic and document handling unless the environment is tuned to watch for suspicious parent-child process chains and external callbacks.

For a broader view of the adversary naming and campaign context around this cluster, Threat Actor Groups Guide is useful background when you are correlating Higaisa activity with other reported group names and aliases.

What Higaisa Does After the First Foothold

Once inside, Higaisa moves into discovery and credential theft so it can turn a single mailbox or workstation compromise into broader access. Discovery helps the actor identify valuable systems, user relationships, and reachable services, while stolen credentials support lateral movement or repeat access without having to re-deliver malware immediately. That combination is often more operationally useful than a loud one-time exploit.

The technique set suggests a focus on persistence through access reuse. If the actor can capture credentials, tokens, or session material, it can return through legitimate-looking logons or remote access paths instead of relying solely on the original payload. That is why abnormal authentication patterns, fresh remote access tooling, and unusual account activity are often more important than the initial phishing event once the incident is underway.

Higaisa also fits the pattern of a group that prefers staged malware over obviously destructive behaviour. Staging gives the operator control over timing, reduces exposure during delivery, and makes it easier to separate infection, tasking, and follow-on collection. In practice, that means defenders should treat a successful document-based infection as the start of a multi-step intrusion rather than a contained endpoint event.

Why the Technique Mix Matters for Defense

The combination of spear phishing, malicious documents, and credential theft creates a risk profile that crosses email security, endpoint hardening, and identity monitoring. If the environment only checks for malware in attachments, it may miss the more important signal, the point at which a user action turns a document into an execution chain and then into authenticated follow-on access.

That is why Higaisa-like tradecraft is often easier to detect in sequence than in isolation. The delivery artifact, the first execution, the discovery activity, and the subsequent login behaviour each look ordinary on their own. The defender’s job is to connect them into one storyline, especially when the actor uses email-based delivery and avoids overt exploit traffic. A practical technique reference point is MITRE ATT&CK Enterprise Matrix, which helps map phishing, credential access, discovery, and lateral movement into a single detection and hunting model.

Practitioner Guidance

What to verify: Check whether suspicious documents actually spawned script interpreters, child processes, or outbound connections, then correlate that with new logon activity from the same user or host. A benign-looking attachment becomes material when it is followed by discovery commands, credential use, or remote access tooling.

Decision rule: If the campaign left evidence of credential capture or authenticated reuse, treat the incident as an identity compromise problem, not just a malware cleanup. Rotation, session invalidation, and access review should move ahead of “did the payload persist?” questions when the actor has likely obtained usable access.

Common mistake: Teams often over-focus on the attachment type and under-focus on post-click behaviour. For this kind of actor, the more decisive indicators are unusual logon patterns, mailbox or endpoint discovery, and the appearance of tools that support remote access after the initial infection.

Practitioner takeaway: Higaisa-style activity should be handled as a chained intrusion: email lure, execution, discovery, and credential-driven follow-on access are the events that matter, not the attachment alone.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?