APT35 has targeted government, defence, technology, telecommunications, academia and media, with campaigns also affecting organisations in regions of geopolitical interest. Security teams in those sectors should watch for credential theft, phishing, impersonation and cloud account abuse, then tighten MFA, conditional access and monitoring for suspicious login patterns and mailbox or token misuse.
What kinds of organisations does APT35 go after?
APT35 concentrates on sectors where stolen access is likely to yield strategic intelligence, operational leverage or long-term persistence. Government, defence, technology, telecommunications, academia and media are recurring targets because they combine high-value data, broad external relationships and exposed collaboration channels. The pattern is less about one industry and more about where trust, secrets and communications can be abused at scale.
Those sectors also tend to have large identity attack surfaces, many contractors and cloud-connected workflows, which makes phishing, impersonation and account abuse especially effective. For defenders, the practical question is not just whether the sector is targeted, but which systems, mailboxes, tokens and privileged accounts are likely to be used as the first foothold.
Why these sectors are attractive to the group
Government and defence organisations hold politically sensitive information, making them valuable for espionage and influence operations. Technology and telecommunications expose infrastructure, customer environments and trusted third-party relationships, while academia often provides access to research, regional partnerships and a broad set of users with uneven security maturity. Media organisations are attractive because compromised accounts can be used for monitoring, impersonation or narrative shaping.
The common denominator is not industry branding, but access density. A sector becomes attractive when a successful login can reveal sensitive correspondence, enable lateral movement into connected systems or support long-running collection without immediate disruption. The more cross-organisation trust a business model depends on, the more useful credential theft and impersonation become.
What defenders in these sectors should watch for
Security teams should treat suspicious login patterns, impossible travel, mailbox rule changes, OAuth consent abuse and unusual token use as sector-relevant warning signs. In practice, APT35-style activity often starts with a believable lure, then pivots into credential capture and stealthy session use rather than loud malware.
That means the most useful detections are often identity and collaboration controls, not only endpoint alerts. Tight MFA, conditional access and continuous review of cloud-authenticated activity matter because an attacker who gets a valid session may never need to trigger a classic perimeter alert.
Risk and Threat Considerations
These sectors face a blended exposure problem: the same access paths that enable global collaboration also make phishing, impersonation and token theft more effective. Once an account is compromised, the attacker can harvest mail, watch conversations, abuse trust relationships and move through cloud services with legitimate-looking activity.
Failure mechanism: Attackers exploit trusted identity flows, weak user verification and overbroad cloud access, then hide inside normal authentication and mailbox behaviour.
Impact: The result can be silent collection, impersonation, loss of confidentiality and extended persistence across email and cloud workloads before the compromise is detected.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK, OWASP Non-Human Identity Top 10, OWASP API Security Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST SP 800-63 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1078 — Valid Accounts | APT35 abuse of stolen logins and sessions maps to valid-account tradecraft. |
| Recommendation — Hunt for valid-account use and anomalous authentication patterns tied to likely compromised sectors. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The question’s sector-specific phishing risk makes phishing-resistant authentication materially relevant. |
| Recommendation — Adopt phishing-resistant authenticators for accounts that can access sensitive mail or cloud services. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Cloud account abuse often depends on exposed tokens, keys or other secret material. |
| NHI-05 — Overprivileged NHI | Overbroad service and cloud permissions increase the damage from compromise in targeted sectors. | |
| NHI-10 — Human Use of NHI | Impersonation and token misuse often succeed when human workflows rely on reusable non-human credentials. | |
| Recommendation — Inventory and rotate exposed secrets that could let attackers reuse trusted access. Reduce excess privilege on cloud and service identities that could amplify a compromised account. Separate human use from machine credentials and remove shared-use access paths. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Cloud and mailbox abuse frequently rides on weak or stolen authentication flows. |
| API5 — Broken Function Level Authorization | Compromised accounts can abuse actions beyond their intended role if authorization is weak. | |
| API9 — Improper Inventory Management | Targeted environments often have shadow apps and forgotten cloud endpoints that widen exposure. | |
| Recommendation — Validate authentication flows and token handling for exposed cloud-facing APIs and services. Check that sensitive actions remain role-restricted even after account compromise. Keep an accurate inventory of cloud apps, mail integrations and exposed services. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The threat pattern centers on stolen identity and misuse of legitimate privilege. |
| ASI09 — Human-Agent Trust Exploitation | Impersonation and social engineering abuse trust relationships, not just technical flaws. | |
| Recommendation — Constrain privileged access paths that a compromised account could abuse. Verify high-risk requests out-of-band when trust relationships can be imitated. | ||
Practitioner Guidance
What to prioritise: Protect the accounts that can read mail, approve access or administer cloud services first. In this threat pattern, those identities are higher value than generic user endpoints because they provide immediate collection and impersonation capability.
What to verify: Confirm that MFA is phishing-resistant where possible, conditional access is tuned to location and device risk, and mailbox forwarding, inbox rules and delegated access are actively monitored. If those controls are weak, assume the sector-specific phishing risk has already become an account-control problem.
Practitioner takeaway: The main defensive objective is to make credential theft less useful, and stolen sessions easier to spot, before the attacker can turn a single login into durable access.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org