Advanced Persistent Threat

en.wikipedia.org | Jan 20th 2010

The "Advanced Persistent Threat" (APT) refers to advanced and normally clandestine means to gain continual, persistent intelligence on an individual, or group of individuals such as a foreign nation state government. While the APT is more commonly thought of as being an article of the computer era, it has existed since the realization of the benefits of intelligence gathering and long before the invention of the computer or internet.

In the computer security community, it is used to specifically refer to a sub-set of such threats, in a long-term pattern of targeted sophisticated hacking attacks aimed at governments, companies and political activists, and by extension, also to refer to the groups behind these attacks. A common misconception associated with the APT relates to its specificity to the targeting of Western governments. While examples of technological APT's against Western governments may be more publicized, this is incorrect, and the technological ('cyber') APT has been used by actors in many nations as a means to gather intelligence on individuals, and groups of individuals of interest.

^[1]^[2]^[3] Some of the groups involved in the APT have been alleged by numerous sources to be affiliated with, or agents of, nation-states. ^[4]^[5]^[6]

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:^[7]

Advanced – Operators behind the threat utilize the full spectrum of intelligence gathering techniques. These may include computer intrusion technologies and techniques, but also extend to conventional intelligence gathering techniques such as telephone interception technologies and satellite imaging. While individual components of the attack may not be classed as particularly “advanced” (e.g. malware components generated from commonly available DIY (Do It Yourself) construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They combine multiple attack methodologies and tools in order to reach and compromise their target.

Persistent – Operators give priority to a specific task, rather than opportunistically seeking immediate financial gain. This distinction implies that the attackers are guided by external entities. The attack is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a “low-and-slow” approach is usually more successful.

Threat – means that there is a level of coordinated human involvement in the attack, rather than a mindless and automated piece of code. The operators have a specific objective and are skilled, motivated, organized and well funded.