Cyber Security Advanced ~ 1.2 Advanced Persistent Threats — What They Are and How to Defend Against Them

## Not Every Attack Is Loud

Most people picture a cyberattack as something sudden and dramatic — a ransomware message on the screen, systems going offline, alarms going off. Advanced Persistent Threats are the opposite. They are quiet, patient, and methodical. By the time you know an APT is inside your network, it may have been there for six months.

That is what makes them so dangerous — and why understanding them is essential for anyone working in cyber security at an advanced level.

---

## What Is an Advanced Persistent Threat?

An Advanced Persistent Threat (APT) is a prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period of time.

The three defining characteristics of an APT are in the name:

**Advanced** — APT actors use sophisticated, custom-built tools and techniques. They combine multiple attack methods, exploit zero-day vulnerabilities, and adapt their tactics in real time to avoid detection. They do not use off-the-shelf malware. They write their own.

**Persistent** — Unlike opportunistic attackers who grab data and leave, APT actors are in it for the long game. They establish multiple footholds, create backup access routes, and maintain their presence over weeks, months, or even years. Removing them is extremely difficult because they plan for the possibility of partial discovery.

**Threat** — APTs are not automated bots or script kiddies. Behind every APT is a skilled, organised, and well-resourced team — typically a nation-state intelligence service or a criminal group operating with nation-state backing. They have specific targets and specific objectives.

---

## Who Are the Targets?

APTs are not random. They are purpose-built operations aimed at high-value targets:

- **Government departments** — defence ministries, intelligence agencies, diplomatic services

- **Critical national infrastructure** — power grids, water treatment, telecommunications

- **Financial institutions** — central banks, trading platforms, payment processors

- **Defence contractors and aerospace** — organisations with access to military technology or classified data

- **Healthcare and pharmaceutical companies** — especially during periods of high-value research such as vaccine development

- **Technology companies** — for intellectual property, source code, and supply chain access

If your organisation sits in any of these sectors, you are a realistic APT target regardless of your size.

---

## The APT Attack Lifecycle

Understanding how an APT operates is essential to defending against it. Most APT campaigns follow a recognisable pattern.

### Phase 1: Reconnaissance

Before launching any attack, APT actors spend significant time gathering intelligence. They study the target organisation's structure, identify key personnel, map the technology stack, and look for suppliers and partners who may offer easier initial access. Open Source Intelligence (OSINT) tools, LinkedIn scraping, and dark web forums are all used at this stage.

### Phase 2: Initial Compromise

Entry into the target network is typically achieved through one of three routes:

- **Spear phishing** — highly personalised emails targeting specific individuals, often impersonating a trusted colleague, supplier, or executive

- **Supply chain compromise** — compromising a trusted software vendor or managed service provider whose products are installed on the target's systems

- **Exploitation of public-facing vulnerabilities** — unpatched web applications, VPN gateways, or remote access systems exposed to the internet

### Phase 3: Establishing a Foothold

Once inside, the attacker installs a Remote Access Trojan (RAT) or backdoor to maintain persistent access. They will typically establish multiple access points — so that removing one does not eliminate their presence.

### Phase 4: Privilege Escalation

The attacker begins moving through the network, looking for credentials that give them elevated privileges. Techniques include credential dumping, pass-the-hash attacks, and exploiting misconfigured services. The goal is to gain domain administrator or equivalent access.

### Phase 5: Lateral Movement

With elevated privileges, the attacker moves laterally through the network — exploring file shares, databases, email systems, and connected environments. This phase can last for months. The attacker is learning the environment and locating the data or systems they came for.

### Phase 6: Data Exfiltration (or Sabotage)

Depending on the objective, the attacker will either:

- **Exfiltrate data** — copying files, emails, intellectual property, or credentials to external servers in a slow, low-volume way designed to avoid triggering data loss prevention alerts

- **Position for sabotage** — planting logic bombs or destructive malware to be triggered at a later date

### Phase 7: Maintaining Presence

Even after achieving their objective, most APT actors maintain their foothold — returning periodically to collect updated data or to prepare for future operations.

---

## Why Are APTs So Hard to Detect?

Several features of APT operations are specifically designed to defeat conventional security controls:

**Living off the land** — APT actors increasingly avoid custom malware altogether, instead using legitimate system tools (PowerShell, WMI, PsExec) to carry out their activities. This makes their actions look like normal administrative behaviour in logs.

**Low and slow exfiltration** — Rather than copying gigabytes of data at once, APTs move small volumes over long periods — staying under the thresholds of data loss prevention systems.

**Encrypted command and control** — Communications between the attacker and their implants are conducted over encrypted channels, often mimicking legitimate HTTPS traffic, making them difficult to distinguish from normal web browsing.

**Dormancy** — Some APT implants lie completely dormant for extended periods, waiting for a specific trigger date or condition before activating. This defeats tools that look for signs of active communication.

---

## How to Defend Against APTs

No single control stops an APT. Defence requires a layered, intelligence-led approach.

### 1. Assume Breach Mentality

Stop designing your security as if the perimeter will hold. Operate under the assumption that a sophisticated attacker may already be inside your network. Design your controls around detecting and containing threats from within, not just blocking them at the edge.

### 2. Network Segmentation

Limit lateral movement by segmenting your network into zones. High-value assets — domain controllers, financial systems, R&D environments — should only be accessible from specific, controlled network segments. A compromised workstation in one zone should not be able to reach critical servers in another.

### 3. Privileged Access Management (PAM)

APTs depend on privilege escalation. Implement a PAM solution that enforces just-in-time access — administrators only receive elevated privileges for specific tasks, for a limited time, and every action is logged. Remove standing privileged accounts wherever possible.

### 4. User and Entity Behaviour Analytics (UEBA)

Deploy UEBA tools that baseline normal behaviour patterns for users and systems — and alert when anomalies are detected. An administrator account accessing file shares at 3am from an unusual location is a behavioural anomaly that a rule-based system might miss but UEBA would flag.

### 5. Threat Intelligence Integration

Subscribe to sector-specific threat intelligence feeds and integrate them with your SIEM. Knowing the tactics, techniques, and procedures (TTPs) of APT groups that target your sector allows you to configure specific detection rules and prioritise patching.

### 6. Email Security and User Awareness

Given that spear phishing remains the most common APT initial access vector, advanced email filtering — including AI-based analysis of email content and sender behaviour — combined with regular, targeted phishing simulation training is essential.

### 7. Incident Response Readiness

Because APTs are often discovered only after extended dwell time, your incident response plan must account for the possibility of a network-wide compromise. This means having forensic investigation capabilities, documented network baselines, and pre-agreed communication protocols ready before an incident occurs.

---

## The Bottom Line

Advanced Persistent Threats represent the most sophisticated and damaging category of cyberattack that organisations face. They are patient, resourced, and specifically designed to defeat conventional defences.

Defending against them requires moving beyond compliance-driven security to a genuinely threat-informed posture — one that combines technical controls, behavioural detection, privileged access management, and a culture of assuming that a determined adversary may already be inside the network.

Understanding APTs is not just an academic exercise. For cyber security professionals working at an advanced level, it is a fundamental operational requirement.