Seven steps of an APT attack from the external network to the domain controller: which step can your red-blue team exercise stop?

Your security team has likely purchased firewall, VPN, WAF, NTA, EDR, HIDS, situation awareness, and other security products, each of which has successfully passed the deployment and acceptance phase.

However, there is one question that very few people dare to answer with absolute confidence: If a real attack group initiated a strike from the external network and made its way all the way to the domain controller, at which exact step would today's line of defense actually stop them?

This is not a hypothetical question. The following attack chain is derived from a real, active, high-level penetration organization (numbered UAT-8302) — which is adept at exploiting known vulnerabilities to establish initial footholds, and rarely drops files onto disks once inside the intranet. Throughout the process, it utilizes "local resources," relying on system-native utilities and open-source security tools to perform reconnaissance, steal credentials, and move laterally, ultimately carrying the data away silently.

We have laid out its complete seven-step attack path here. Not to make you nervous, but because — the attacker's playbook is precisely the best script to test your defense. After reading it, you will find that every single step corresponds to a phase that you should have been able to stop, but might not actually be able to.

First, let's meet the adversary.

UAT-8302 is not an ordinary cybercrime gang, but a state-sponsored APT group whose objectives are long-term persistence and intelligence theft. It was first publicly disclosed by an internationally authoritative security research team in May 2026.

Since late 2024, it has continuously launched targeted attacks against government agencies in multiple regions, and has not yet been linked to any previously known historical campaigns — in other words, it appeared with almost "a face without fingerprints," making it highly difficult for traditional signature-based defense systems to recognize it at the first opportunity.

What troubles defenders most about this organization are three key characteristics:

First, they are "adept at borrowing weapons." They rarely reinvent the wheel from scratch. Instead, they heavily reuse malware and open-source tools that have already been validated by other high-level APT groups. This "shared arsenal" approach enables faster attack deployment and blurs attribution — once you capture a tool, it might be connected to an entire attacking ecosystem behind the scenes.

Second, they are "extremely patient." After gaining access to the internal network, they do not rush to act. Instead, they perform wide-ranging, systematic reconnaissance to map out every reachable host and confirm the boundaries of the entire environment before deciding on the next move. This style of patience, restraint, and prioritizing long-term stealth over loud disruption is a classic hallmark of high-level state-sponsored operations.

Third, they "live off the land." The post-compromise phase relies heavily on "living-off-the-land attacks" — using system-native commands and open-source security testing tools as much as possible to complete reconnaissance, credential theft, and lateral movement, while minimizing the creation of malicious files on disk. As a result, their activities blend in with legitimate administrative traffic, making it extremely difficult for ordinary monitoring tools to distinguish whether "this is an attack" or "this is just an administrator doing their job."

The following attack chain represents the complete seven steps it takes to get from the external network to the domain controller. We will break down each step — you will find that every action corresponds to a phase that you should have been able to stop, but might not actually be able to.

Below is the stage-by-stage breakdown of this attack chain.

Phase 1: Initial Access

Attack Description: Attackers first exploit N-day vulnerabilities to gain initial access, successfully breaching the corporate network perimeter. The specific vulnerabilities exploited include a stack-based buffer overflow vulnerability in Pulse Secure SSL VPN (CVE-2019-11542) and an authentication bypass vulnerability in Ivanti Pulse Connect Secure VPN (CVE-2023-46805).

Execution Tasks:

Exploit Pulse Secure SSL VPN CVE-2019-11542 stack-based buffer overflow vulnerability for initial breach

Exploit Ivanti Pulse Connect Secure VPN CVE-2023-46805 authentication bypass vulnerability for initial access

Phase 2: Execution

Attack Description: Attackers executed the VShell backdoor on the target system. By calling the RtlLeaveCriticalSection function, they forced the release of the loader Lock, and searched for specific signatures in the .text section of ntdll.dll, hardcoding them to specific values to disable the Fast-Fail security detection for loader Lock hijacking in modern Windows operating systems. Finally, they read the "bin" file in the malicious dll directory, and injected the malicious payload into the explorer.exe process for execution.

Execution Tasks:

Execute the VShell backdoor program delivered by the UAT-8302 threat group to achieve fileless execution and memory persistence

Phase 3: Command and Control

Attack Description: Attackers rapidly established a communication tunnel to set up a persistent and stealthy C&C (Command and Control) connection. VShell is an open-source, cross-platform Remote Access Trojan (RAT) developed in Golang, supporting Windows, Linux, and macOS systems. It possesses basic post-exploitation features such as remote command execution, file upload/download, and system information collection. It also supports WebSockets encrypted communication, enabling real-time, stealthy, and difficult-to-detect C&C channels.

Execution Tasks:

Establish VShell v4.9.3 C&C callback heartbeat communication (WebSockets encrypted communication)

Establish VShell v4.9.3 C&C callback heartbeat communication (TCP communication)

Phase 4: Collection

Attack Description: After successfully establishing a foothold, the attackers conducted extensive asset and environment reconnaissance within the internal network. They first used system commands to display detailed configuration information about the computer, and immediately followed up by enumerating network shares and executing the httpx security tool to scan and rapidly map out the surrounding network topology and active assets.

Execution Tasks:

Use "systeminfo" to display detailed configuration information about the computer (OS configuration, security information, hardware properties, etc.)

Use "ipconfig /all" to display all current TCP/IP network configuration values

Perform network share enumeration under the domain environment, listing domain host names and share directory names

Execute the httpx tool scan to obtain web service information in the network (URLs, titles, status codes, content lengths, etc.)

Phase 5: Credential Access

Attack Description: To gain core control over the internal network, the group focused on breaching authentication systems. They executed the SharpGetUserLoginIPRPC tool to extract log information to track the activity trails of high-privileged users, and executed the ADExplorer.exe tool to create AD database snapshots for offline domain structure and privilege analysis. Additionally, the attackers executed the MobaXtermDecryptor tool to extract credentials, successfully stealing sensitive connection passwords saved locally by operations personnel.

Execution Tasks:

Execute the SharpGetUserLoginIPRPC tool to query user login IP addresses and related login information from local log files

Execute the MobaXtermDecryptor tool to extract user credentials (remote connection passwords) saved by the MobaXterm program

Execute the ADExplorer.exe tool to create AD database snapshots (backup.data file) for offline domain structure and privilege analysis

Phase 6: Lateral Movement

Attack Description: Equipped with critical credentials and the internal network structure, the attackers leveraged native system tools to perform lateral movement, successfully expanding their control to other core servers and critical terminals, thereby achieving deep penetration of the target network environment.

Execution Tasks:

Use WMIC to execute processes on remote computers to achieve WMI-based lateral movement

Use the SMBExec module of the Impacket tool to execute commands on remote computers via the SMB protocol

Phase 7: Exfiltration

Attack Description: Attackers exfiltrated the collected device data files back to the remote control server via the VShell C&C channel, completing the data theft. VShell supports file upload/download functions, allowing attackers to utilize its encrypted communication channel to covertly exfiltrate sensitive data out of the target network.

Execution Tasks:

Exfiltrate device data files to the remote control server via the VShell C&C channel

Mitigation & Detection Recommendations

VPN Device Vulnerability Management

Promptly patch high-risk vulnerabilities (such as CVE-2019-11542, CVE-2023-46805, CVE-2024-21887) on remote access devices like Pulse Secure SSL VPN and Ivanti Pulse Connect Secure VPN; monitor VPN devices in real-time for anomalous access behaviors and external vulnerability exploitation attempts.

Memory Injection and Fileless Attack Detection

Deploy EDR products with memory forensics capabilities to monitor abnormal memory allocation and behavior of system processes such as explorer.exe; detect anomalous calls to low-level functions like RtlLeaveCriticalSection and modifications to the .text section of ntdll.dll.

C&C Communication Traffic Detection

Monitor anomalous outbound WebSocket connections and long-lived TCP connections from the internal network; identify signature traffic of open-source RAT tools like VShell; perform Deep Packet Inspection (DPI) on C&C communications utilizing non-standard ports (such as 8084, 8085).

Host Information Gathering Command Monitoring

Log and alert on anomalous execution of system information gathering commands such as systeminfo and ipconfig /all; monitor the execution of network scanning tools like httpx and Advanced IP Scanner in non-security-testing scenarios.

Credential Theft Tool Detection

Monitor the execution of credential theft and domain information gathering tools like SharpGetUserLoginIPRPC, MobaXtermDecryptor, and ADExplorer.exe; monitor and alert in real-time on creation operations of AD database snapshots (backup.data files).

Lateral Movement Behavior Detection

Audit and restrict the use of remote command execution tools like WMIC and Impacket SMBExec; log and detect anomalies in cross-host SMB and WMI remote connections; enforce network segmentation and least privilege principles to limit the lateral movement scope of attackers within the internal network.

Having written this far, only half of the problem is actually solved.

Every single one of the seven recommendations above is correct. However, they are all built on one default premise: the devices you deployed are actually working as expected. Reality is often quite different — EDR is installed, but the rules are not tuned to recognize memory injection; NTA is running, but no one is watching long-lived connections on non-standard ports; vulnerability patches are claimed to have been applied, but whether that CVE on the VPN device has actually been fixed is something nobody has circled back to verify.

Attackers won't go easy on you just because you bought products. They only care about one thing: At which exact step will this chain actually break?

Therefore, a more pragmatic approach is to use this attack playbook in reverse — turn every execution task of UAT-8302 into a verification action that can be run repeatedly in your own environment. Simulate the real attack techniques within your own network to see which of the seven stages are blocked and which ones enjoy a free pass, and then go back to patch the genuine weaknesses. Some teams in the industry have already adopted this "attack-to-verify-defense" mindset, converting scattered alert rules into a continuously operating verification chain — discovering an attack technique, validating it, confirming the defense works, and then moving on to the next one.

Whether a line of defense is effective should not be proven by a procurement list, but verified through repeated, realistic simulations.

In your environment, for how many of these seven steps do you dare to confidently say, "We will definitely stop them"? Let's discuss in the comments.

Reference Source:

https://blog.talosintelligence.com/uat-8302/