Advanced persistent threat (APT) is commonly used to refer to cyber threats, in particular that of Internet-enabled espionage using a variety of intelligence gathering techniques to access sensitive information, but applies equally to other threats such as that of traditional espionage or attack.
Other recognized attack vectors include infected media, supply chain compromise, and social engineering.
Individuals, such as an individual hacker, are not usually referred to as an APT as they rarely have the resources to be both advanced and persistent even if they are intent on gaining access to, or attacking, a specific target.
APT typical approach is as follows:
- Target specific organizations for a singular objective
- Attempt to gain a foothold in the environment, common tactics include spear phishing emails.
- Use the compromised systems as access into the target network
- Deploy additional tools that help fulfill the attack objective
- Cover tracks to maintain access for future initiatives
In 2013, Mandiant presented results of their research on alleged Chinese attacks using APT methodology between 2004 and 2013 that followed similar lifecycle:
- Initial compromise — performed by use of Social engineering (security) and spear phishing, over email, using zero-day viruses.Another popular infection method was planting malware on a website that the victim employees will be likely to visit.
- Establish Foothold — plant remote administration software in victim’s network, create network backdoors and tunnels allowing stealth access to its infrastructure.
- Escalate Privileges — use exploits and password cracking to acquire administrator privileges over victim’s computer and possibly expand it to Windows domain administrator accounts.
- Internal Reconnaissance — collect information on surrounding infrastructure, trust relationships, Windows domain structure.
- Move Laterally — expand control to other workstations, servers and infrastructure elements and perform data harvesting on them.
- Maintain Presence — ensure continued control over access channels and credentials acquired in previous steps.
- Complete Mission — exfiltrate stolen data from victim’s network.
Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:
- Advanced – Operators behind the threat have a full spectrum of intelligence-gathering techniques at their disposal.These may include computer intrusion technologies and techniques, but also extend to conventional intelligence-gathering techniques such as telephone-interception technologies and satellite imaging.While individual components of the attack may not be classed as particularly “advanced” (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required.They often combine multiple targeting methods, tools, and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from “less advanced” threats.
- Persistent – Operators give priority to a specific task, rather than opportunistically seeking information for financial or other gain.This distinction implies that the attackers are guided by external entities.The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives.
It does not mean a barrage of constant attacks and malware updates.
In fact, a “low-and-slow” approach is usually more successful.If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator’s goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.
- Threat – APTs are a threat because they have both capability and intent.APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code.The operators have a specific objective and are skilled, motivated, organized and well funded.