What tactics and techniques does Threat Group-3390 use?

How Threat Group-3390 Gets In and Stays In

Threat Group-3390’s playbook is a classic intrusion chain: gain initial access, establish a foothold, then expand access until the environment can be searched, controlled, and exfiltrated from. The initial access methods matter because they shape the rest of the response. MITRE ATT&CK Enterprise Matrix is the best lens for mapping those stages to concrete tactics such as initial access, credential access, lateral movement, and collection.

The group’s use of phishing and stolen credentials means defenders should treat account abuse as an intrusion indicator, not just a login issue. Once access is obtained, exploitation of public-facing systems can provide the same operational outcome as credential theft, so external service exposure and authentication abuse both need to be in scope. That is why CISA cyber threat advisories remain useful for watching the broader patterns of current intrusion tradecraft.

After entry, the group’s move toward malware or remote access tooling indicates a need for persistence and operator flexibility. In practice, that often means the attacker is trying to keep a controllable channel even if one technique is disrupted. The same early-stage access can also be reused for privilege escalation or lateral movement, so the first successful compromise is often the point at which the incident becomes materially harder to contain.

What the Group Does After First Compromise

Once inside, the main objective shifts from access to operational reach. Lateral movement expands the blast radius, while collection turns that reach into theft of data, credentials, or internal context that supports follow-on activity. Threat Hunting Guide is a practical companion here because it frames how to look for the sequence of abnormal authentication, internal movement, and post-compromise behavior rather than chasing isolated alerts.

The group’s techniques also suggest that defenders should not over-focus on a single initial vector. Phishing, stolen credentials, and public-facing exploitation are different entry paths, but they converge on the same post-compromise behaviors: remote execution, administrative use from unusual locations or hosts, and data staging. That convergence is what makes group-level tradecraft useful for detection engineering, because the defensive pattern is broader than any one lure or exploit.

For practitioners, the most important signal is the transition from access to action. Unusual admin activity, service abuse, and abnormal internal movement are often stronger indicators of active compromise than the original phishing or exploit event itself, especially when the attacker blends into normal administration workflows.

Which Behaviors Are Most Useful for Detection

Detection should emphasize activity patterns that are hard to justify in normal operations. Examples include unexpected account logins, new geo-temporal access patterns, atypical use of public-facing services, and remote execution from systems that should not normally act as operators. Top 10 Phishing Techniques is relevant because phishing remains one of the easiest ways to seed the access path that later enables the rest of the intrusion.

Defenders should also separate the first compromise from the later-stage operator behavior. A single malicious login may be the start, but the more meaningful evidence is what happens next: mailbox or file access outside normal patterns, internal reconnaissance, use of administrative tooling, and data collection from systems that have no obvious business reason to be queried in that way. That sequence is what turns an account event into an intrusion case.

Where available, threat intelligence should be used to enrich hunting, not replace it. The same group may reuse familiar methods across campaigns, but hunting becomes more reliable when it is anchored to observable behaviors such as credential abuse, service exploitation, and lateral movement rather than to a fixed indicator list.

Risk and Threat Considerations

The main risk is that the earliest access step can look routine, especially when stolen credentials are used. That makes the group attractive to attackers because it can bypass noisy exploit chains and move straight into internal activity that resembles legitimate use until the attacker starts moving laterally or collecting data.

Failure mechanism: Phishing, credential theft, and public-facing exploitation can each create valid access that survives basic perimeter checks, then malware or remote tooling can extend that access into persistent internal control.

Impact: Once the attacker can move laterally and collect data, containment becomes slower and more expensive, and the compromise may spread beyond the first affected system or account.

Practitioner Guidance

What to verify: Confirm whether the affected accounts, hosts, or public services show a before-and-after change in behavior, not just a single suspicious event. The most useful evidence is a chain: initial access, unusual internal activity, then collection or remote administration.

Decision rule: If the compromise path includes a valid account or an internet-facing system, treat the incident as an access-control and containment problem first, and a malware-cleanup problem second. That ordering usually shortens dwell time because it forces you to look for where the attacker could still authenticate or execute.

Practitioner takeaway: For Threat Group-3390, the decisive question is not which lure or exploit was used first, but whether defenders can quickly spot the shift from initial access to internal operator behavior before lateral movement and collection widen the blast radius.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques does Threat Group-1314 use?
• What tactics and techniques does Gorgon Group use?
• What tactics and techniques does Gamaredon Group use?
• What tactics and techniques does Poseidon Group use?