Skip to content
Cyber Unboxed

Patient, well-resourced adversaries

Advanced Persistent Threats

Advanced persistent threat (APT) describes well-resourced adversaries who aim to stay hidden in a network for a long time. This page describes the general pattern only, without attributing any incident to anyone.

Motivation: Intelligence gathering or strategic objectives, typically over a long period.

Overview

The term advanced persistent threat describes behaviour, not a particular group: a determined adversary with the resources and patience to pursue a specific objective. Such operations are often associated with intelligence gathering or strategic goals, and may be linked to state interests, though public attribution should always rely on cited evidence.

What sets them apart is persistence. Rather than grabbing what they can and leaving, they establish several ways back in, learn the network carefully, and move slowly to the systems that hold what they want. They often use built-in administration tools and valid accounts, so their activity looks like routine work.

Defending against them is less about one perfect tool and more about layers: strong identity controls, limiting who can reach what, good logging kept for a long time, and people actively hunting for signs rather than waiting for alerts.

How it unfolds

  1. 1

    Target and research

    A victim is chosen and studied carefully.

  2. 2

    Initial access

    Targeted phishing, a chosen weakness or a supplier relationship.

  3. 3

    Establish persistence

    Several separate ways to return are set up.

  4. 4

    Move quietly

    Privileges are raised and the network is explored carefully.

  5. 5

    Collect and stay

    Data of interest is gathered slowly and access is kept.

Common techniques

  • Targeted phishing

    Messages written for specific individuals using researched details.

  • Living off the land

    Built-in tools are used so there is little malware to detect.

  • Multiple persistence methods

    Scheduled tasks, services or accounts that let access survive clean-up.

  • Low-and-slow collection

    Small, regular data transfers that avoid raising alarms.

  • Use of trusted relationships

    Suppliers and partners used as a route in.

Who is targeted

  • Government and public bodies
  • Defence, energy and other critical sectors
  • Technology and research organisations
  • Suppliers that provide a route to other targets

An example

A logging review finds a rarely used account signing in at the same quiet hour every week and reaching a file share it has never used. Nothing looks malicious on its own, but the regularity and the choice of target suggest someone who has been there for a long time.

An illustrative scenario, not a report of a specific incident.

What to look for

  • Small, regular connections to unfamiliar servers
  • Administration tools used by accounts that never normally use them
  • New scheduled tasks, services or accounts nobody created
  • Interest in a narrow set of high-value data

How to defend

  1. Assume a determined adversary may already be present and hunt for signs
  2. Limit standing access, segment sensitive systems and require MFA for administrators
  3. Keep logs for a long period, since the first sign may be months old
  4. Monitor command-line activity and use of administration tools
  5. Scrutinise supplier and partner access

Key terms

Persistence
Ways an attacker keeps access after a reboot or password change.
Tradecraft
The methods and habits an adversary uses.
Attribution
Linking an activity to a specific actor, which requires strong evidence.
MITRE ATT&CK
A public catalogue of adversary tactics and techniques.

This is a general profile of a type of threat. It does not attribute any specific incident to any named group.

Go deeper on advanced persistent threats

Back to the Threat Atlas