What tactics and techniques does Operation AkaiRyū use?

How Operation AkaiRyū establishes and maintains access

The reported tradecraft starts with gaining a foothold, then preserving it long enough to collect targeted data without drawing attention. In practice, that means the campaign is less about a single exploit and more about chaining access steps: initial delivery, persistence, and repeatable execution that blends into normal administrator or user activity.

Once inside, operators commonly rely on phish delivery or exposed services as entry points, then use scripts and native system tools to stay resident. That mix matters because it lowers the friction of repeated access and makes activity look like ordinary troubleshooting, automation, or remote administration.

What techniques make the campaign harder to spot

Two features stand out: living-off-the-land activity and deliberate avoidance of detection. Living-off-the-land means the operators prefer built-in utilities, command shells, and legitimate scripting rather than custom malware where possible. That reduces the number of obvious malware signatures defenders can rely on and increases the chance that suspicious actions are buried inside routine system noise.

The reported encoded commands fit the same pattern. Encoding is often used to conceal command content from casual review, weaken simple content filters, and make logs harder to interpret quickly. Repeated access to sensitive repositories or credentials is also a practical indicator because targeted collection tends to revisit the same high-value locations until the operator has what they need.

For a campaign like this, MITRE ATT&CK Enterprise Matrix is the most useful lens for mapping the observed behavior to tactics such as initial access, persistence, credential access, and defense evasion. If you want a threat-centric starting point for the phishing side of the intrusion chain, NHIMG’s Top 10 Phishing Techniques helps frame the delivery methods that commonly precede this kind of access.

What defenders should look for first

The fastest way to validate exposure is to look for the campaign’s operational signatures rather than waiting for a confirmed compromise. Authentication anomalies, unusual script execution, encoded command lines, and repeated access to repositories or credential stores are all useful review points because they reflect the way the intrusion is being sustained and exploited.

Focus on where those signals intersect. A single encoded command may be benign, but encoded execution followed by unusual logon patterns and access to sensitive locations is much more consistent with hands-on activity. Also pay attention to exposed services that should not be reachable from the internet, because they often serve as the first foothold when phishing is not the entry route.

SANS Security Resources is a useful practical reference for detection engineering and incident handling patterns around suspicious command execution and post-compromise behavior. For broad defensive mapping of attacker behavior and countermeasures, MITRE D3FEND provides a structured way to think about defenses against the types of tactics seen in this campaign.

Risk and Threat Considerations

Campaigns built around legitimate tools and encoded execution are hard to distinguish from normal administration until the access pattern becomes repetitive. That creates a real risk of delayed detection, especially when the operator is focusing on a small set of sensitive targets rather than broad noisier activity.

Failure mechanism: The attack abuses trusted access paths, then hides behind native tooling, encoded commands, and repeated low-and-slow access to maintain persistence and collect data.

Impact: Defenders may miss the intrusion until the operator has already reached sensitive repositories, harvested credentials, or established enough access to continue operating after the first foothold is removed.

Practitioner Guidance

What to verify: Correlate authentication events with script execution and repository access. If those three line up around the same host, user, or time window, treat it as a stronger compromise hypothesis than any one signal alone.

Decision rule: If the suspicious activity touches credentials, secrets, or privileged repositories, prioritise containment and access review before spending time on full attribution. The key question is whether the access path is still open, not which named campaign it most closely resembles.

Practitioner takeaway: The most useful response posture is to hunt for the operator’s repeatable access pattern, because the campaign’s real advantage is not novelty, but persistence disguised as ordinary activity.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques does Operation Dream Job use?
• What tactics and techniques does Operation Sharpshooter use?
• What tactics and techniques does Operation MidnightEclipse use?
• What tactics and techniques does Operation Honeybee use?