What tactics and techniques does Operation Sharpshooter use?

What Operation Sharpshooter actually did

operation sharpshooter was an intrusion campaign built around staged delivery and hands-on follow-through. The activity used weaponised documents to get an initial foothold, then relied on scripts and additional payloads to turn that access into credential theft, malware deployment, and broader environment access. The key question for defenders is not just which file arrived, but what execution and network steps followed it.

That sequence matters because the initial document is only the start of the attack chain. Once a user opens the lure and code execution begins, the campaign can move from document abuse into script-based execution, callback traffic, and later-stage compromise behaviours that are much easier to miss if teams only look for the first malicious attachment.

For a campaign-level view of how these intrusion patterns are organised and tracked, Threat Actor Groups Guide is useful background on how threat groups, aliases, and campaign naming are handled in practice.

How the attack chain is usually recognised

The most reliable way to understand this operation is to break it into observable behaviours. First comes document abuse, often through Office files designed to coax execution. Next comes malicious script activity, which can bridge the gap between a user opening a file and the system downloading or launching secondary code. After that, defenders should look for staged payload delivery, which often appears as small initial code that reaches out for more content before the main malware runs.

Credential collection is a major objective in this type of chain, so abnormal prompts for authentication, token theft behaviour, or unexpected logon use can be as important as the malware itself. Once credentials are exposed, the campaign can shift into lateral movement and internal discovery, which is why one compromised workstation can quickly become an enterprise issue.

For the adversary perspective on delivery and credential theft patterns, MITRE ATT&CK Enterprise Matrix is the best reference for mapping document, script, credential access, and lateral movement behaviours to known techniques.

The detection angle is straightforward but demanding: teams need to correlate document creation or opening events with script execution, unusual child processes, outbound callbacks, and any follow-on movement that does not fit the user’s normal workflow.

What defenders should watch for and contain first

Operation Sharpshooter is a good example of why first-stage malware, second-stage payloads, and credential theft should be treated as one problem rather than separate alerts. If a document launch is followed by scripting, network callbacks, or authentication anomalies, the incident should be handled as an active intrusion path, not just a suspicious attachment.

• Look for Office files that trigger macro, script, or interpreter activity soon after delivery.
• Correlate outbound callbacks with the host that opened the document, especially when the destination is unfamiliar.
• Check for privilege changes, new remote access, or internal movement after the initial execution event.
• Review whether the same account or host was used to access multiple systems shortly after the lure was opened.

For defenders who want a control-oriented view of why document abuse so often turns into credential access and movement, SANS Security Resources is a practical place to reinforce detection engineering and incident-response playbooks around this sort of chain.

Practitioner Guidance

What to prioritise: Treat the document as the delivery mechanism, not the whole incident. The highest-value evidence is the sequence after opening, especially script launch, payload retrieval, and the first signs of credential use beyond the original user context.

What to verify: Confirm whether the host executed scripting engines, spawned unusual Office child processes, or made network connections that do not align with the user’s normal document workflow. If those indicators are present, assume the attack progressed beyond simple phishing.

Decision rule: If the lure led to authentication exposure or internal movement, move immediately to containment and credential review before spending time on cosmetic cleanup of the original file.

Practitioner takeaway: Campaigns like this are best defeated by chaining evidence together early, because the operational risk sits in what the document enables after execution, not in the attachment alone.

Related resources from NHI Mgmt Group

• What tactics and techniques does Operation Dream Job use?
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?