An advanced persistent threat (APT) is a targeted intrusion campaign in which a capable attacker seeks sustained, stealthy access to a network or cloud environment. The objective is commonly espionage, surveillance, strategic data theft, or long-term access rather than a quick, noisy attack.
APT is not one malware family. It can describe the campaign, the actor conducting it, or an activity cluster tracked by researchers. Different governments and security vendors may assign different names to the same or overlapping activity.
What makes a threat advanced, persistent, and targeted?
- Advanced: the operator combines multiple techniques, adapts to defenses, and may use custom malware, stolen legitimate tools, or previously unknown vulnerabilities.
- Persistent: the operation maintains or repeatedly regains access over an extended period.
- Threat: a person or organized group has intent, capability, and an objective. Automated malware without an active operator is not automatically an APT.
Not every sophisticated breach is an APT, and not every APT action uses advanced code. Valid credentials and built-in administration tools can be more useful to a stealthy operator than obvious malware.
Typical APT lifecycle
| Stage | Attacker objective | Evidence defenders may find |
|---|---|---|
| Reconnaissance | Identify people, suppliers, exposed services, and valuable systems. | Targeted scanning, credential-harvesting activity, and research-driven spear phishing. |
| Initial access | Obtain the first account or system foothold. | Suspicious sign-ins, exploited internet-facing services, malicious attachments, or stolen session tokens. |
| Execution and persistence | Run tools and preserve access after restart or password changes. | New services, scheduled tasks, startup changes, cloud applications, keys, or unexpected identity providers. |
| Privilege escalation and credential access | Reach more powerful identities and protected systems. | Credential dumping, unusual directory queries, token theft, and administrative role changes. |
| Discovery and lateral movement | Map the environment and move toward the objective. | Remote administration from unusual hosts, internal scanning, abnormal SMB/RDP/SSH use, and access to many systems by one identity. |
| Command and control | Issue instructions and maintain operator access. | Periodic beaconing, unusual DNS or encrypted traffic, new remote-management tools, and connections to rare destinations. |
| Collection and exfiltration | Stage and remove selected data. | Large archives, access outside normal roles, cloud-storage uploads, and unusual outbound volume. |
The stages are not always linear. An operator may repeat discovery, add new footholds, pause activity, or return after defenders close one access path.
Common initial access methods
- Targeted phishing and malicious attachments.
- Stolen passwords, session cookies, API keys, or OAuth tokens.
- Exploitation of unpatched internet-facing applications and network devices.
- Compromised suppliers, software updates, managed-service providers, or trusted relationships.
- Exposed remote access, weak MFA enrollment, and misconfigured cloud services.
- Insiders or physical access in higher-risk environments.
A zero-day vulnerability can be used, but it is not required. Many long-running intrusions begin with known weaknesses or valid credentials.
APT warning signs
- Successful sign-ins from unusual infrastructure, devices, locations, or at impossible travel intervals.
- New privileged accounts, authentication methods, mail-forwarding rules, or application consents.
- Administrative tools such as PowerShell, WMI, PsExec, SSH, or remote monitoring used by unexpected identities or hosts.
- Security controls, logs, or endpoint agents disabled selectively rather than everywhere.
- Repeated access to sensitive repositories outside normal working patterns.
- Small, regular command-and-control connections or DNS activity that differs from the host's baseline.
- Compressed data staged in temporary locations followed by unusual outbound transfer.
No single indicator proves an APT. Detection usually comes from correlating identity, endpoint, network, email, cloud, and data-access evidence over time.
How to respond to a suspected APT
- Activate incident response. Establish decision authority, secure communications, legal requirements, and evidence handling.
- Preserve evidence. Collect relevant logs, volatile data, cloud audit records, endpoint timelines, and suspicious files before they expire or are altered.
- Determine the scope. Hunt for related accounts, hosts, tokens, persistence, and external infrastructure. Assume one visible alert may be only part of the intrusion.
- Contain deliberately. Isolate affected assets and block known infrastructure while considering whether premature broad changes could cause the operator to destroy evidence or switch access paths.
- Remove every access path. Patch exploited systems, revoke sessions and tokens, rotate credentials and keys from clean devices, remove persistence, and rebuild systems that cannot be trusted.
- Recover and monitor. Restore in stages, validate business functions, and watch closely for renewed access.
Do not rely on a single malware removal or organization-wide password reset. If stolen tokens, federation trust, service accounts, or network-device access remain, the attacker may persist.
How organizations reduce APT risk
- Inventory internet-facing and critical assets, patch them quickly, and remove unnecessary exposure.
- Use phishing-resistant MFA, privileged-access controls, separate administrator accounts, and short-lived credentials.
- Segment critical systems and restrict management protocols between zones.
- Collect high-quality identity, endpoint, DNS, proxy, network-device, cloud, and data-access logs in a protected location.
- Deploy endpoint detection and response and hunt for behavior across multiple systems instead of isolated file names.
- Restrict and monitor remote-management tools, scripting, application consent, and data transfers.
- Test incident-response and recovery plans, including restoration of identity and network infrastructure.
Frequently asked questions
Is an APT always state-sponsored?
No. The term is strongly associated with state-linked espionage, but any capable, well-resourced group may conduct a persistent targeted campaign. Attribution requires more evidence than a malware name or IP address.
How long does an APT remain in a network?
There is no fixed duration. Access can last days, months, or longer, and operators may return after a quiet period. Retaining useful logs is essential for reconstructing older activity.
Can antivirus stop an APT?
Antivirus may block some payloads, but an APT can also use valid accounts, trusted tools, cloud services, and network devices. Effective defense requires identity security, patching, segmentation, logging, behavioral detection, and practiced response.