Questions tagged [apt]

APT Stands for "Advanced Persistent Threat". It is usually used in reference to a threat posed by a group with the capability and intent to persistently and effectively carry out cyber attacks against specific entities.

APT has been used to refer to either the perpetrators, or the actual hack itself (typically when there is no attribution).

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:

Advanced – Operators behind the threat have a full spectrum of intelligence gathering techniques at their disposal. These may include computer intrusion technologies and techniques, but also extend to conventional intelligence gathering techniques such as telephone interception technologies and satellite imaging. While individual components of the attack may not be classed as particularly “advanced” (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from "less advanced" threats.

Persistent – Operators give priority to a specific task, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a “low-and-slow” approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.

Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code. The operators have a specific objective and are skilled, motivated, organized and well funded.

From Wikipedia: Advanced Persistent Threat

48 questions
16
votes
2 answers

What are prudent security precautions to take for business travel by people with access to sensitive info?

The New York Times had a front-page article today: Traveling Light in a Time of Digital Thievery, aka "Electronic Security a Worry in an Age of Digital Espionage". Former director of US national intelligence Mike McConnell is quoted as saying “In…
nealmcb
  • 20,783
  • 6
  • 72
  • 117
4
votes
0 answers

What does Lockheed's StarVision do and what are some comparable products on the market?

I consult for a client who has Lockheed's StarVision as part of their advanced persistent threats tool set. For various political and business reasons, I have not been able to get a close-up look of the StarVision tool. I tried to "google"…
user68006
1
vote
0 answers

Is the usage of "wocao" in this context unprecedented?

In this whitepaper, they use a HTTP server history (see screenshot) as the basis for the codename of an identified attack, "Operation…
Cireo
  • 111
  • 2
1
vote
0 answers

APT Attribution

Given that most characteristics of binaries can be spoofed and seeing from the CIA documents published on Wikileaks that at least that organization is cautious to deploy several methods such that their malware cannot be linked to each other and…
Tobi Nary
  • 14,417
  • 8
  • 45
  • 58