APT: The Attackers Who Are Willing to Wait

The 30-second explanation

Most attackers grab what they can and leave. An APT settles in, moves slowly, and keeps access for months so it can quietly collect what it came for.

How it works

1. 1

   1. Target

   Choose a victim and research it.

2. 2

   2. Enter

   Targeted phishing or a chosen weakness.

3. 3

   3. Persist

   Set up several ways back in.

4. 4

   4. Collect

   Slowly gather the data of interest.

The term describes behaviour, not a specific group: a determined adversary with resources and a specific objective. They often start with targeted phishing or an exposed service, then establish several ways back in, learn the network, and move carefully to the systems that hold what they want. They avoid noisy actions and often use built-in tools. Public attribution to a particular state or organisation should rely on cited evidence, and this page describes the general pattern only.

Real-world example

How to spot it

• Regular, quiet beacons

  Small, periodic connections to unfamiliar servers.

• Legitimate tools used oddly

  Administration tools run by accounts that never used them.

• Persistence in odd places

  New scheduled tasks, services or accounts nobody created.

• Access to sensitive data only

  Interest in a narrow set of high-value files.

What to do

1. 1Assume a determined attacker may already be inside, and hunt for signs rather than only waiting for alerts.
2. 2Reduce standing access, segment sensitive systems and require MFA for administrators.
3. 3Keep long log retention, since the first sign of access may be months old.