Home / Knowledge hub / Advanced persistent threat
Knowledge hub
Advanced persistent threat
A skilled attacker who stays hidden in a network for a long time.
What it means
An advanced persistent threat, or APT, is an adversary with significant skill and resources who pursues its goals over a long period, adapts to the defenders' responses, and works to stay inside the target. NIST's definition describes these three traits.
The word persistent is the key. This is not a smash and grab. The group may spend weeks studying a target, move slowly to avoid alarms, and return by a second route if the first one is closed. Speed is not the aim; staying hidden is.
Why it matters
APTs are usually linked to organised groups or states, with goals such as espionage, theft of intellectual property or access to a customer's network. They often go after suppliers, because a trusted software vendor is a path into many better-defended targets.
That matters for small and mid-sized software firms. You may not hold the prize yourself, but your code, your credentials or your access to a customer can be the stepping stone. Being a small target is not a defence when you are on the path to a large one.
How it shows up
You will rarely see an APT as a single event. The signs are small: a service account active at odd hours, data moved to a place it has never gone, logs that stop, a new remote access tool. Attackers use stolen credentials and built-in tools so they blend in, then move sideways through the network. See lateral movement.
Defence is about slowing and spotting. Limit what each account can reach, keep and review logs, segment networks, patch internet-facing systems quickly, and hunt for odd behaviour using a framework such as MITRE ATT&CK. Plan on the assumption that someone may already be inside.
Questions people ask
Advanced persistent threat, answered
Is an APT a type of malware?
No. It is a type of adversary, a group or campaign. They may use malware, stolen credentials, phishing and legitimate tools, whichever suits.
Many APT operations use little custom malware at all.
Do small companies get targeted by APTs?
Sometimes, as a route to someone else. Software vendors, agencies and service providers hold access to customers, which makes them attractive.
You do not need to be the final target to be involved.
How long can an APT stay undetected?
Reports from incident responders often describe weeks or months. The time varies greatly, and Do not trust a single average figure.
Better logging and regular hunting shorten the time.
How do we detect one?
Look for behaviour rather than known files: unusual sign-ins, odd use of admin tools, large transfers, new accounts or tokens, and gaps in logs.
This is the work of threat hunting, supported by good logging.
Can penetration testing help against APTs?
It helps close the gaps they would use to get in or move around, such as weak access control and exposed services. It cannot simulate a patient, well-funded adversary in full.
A red team exercise gets closer.
Sources
Where this comes from
Related
Terms that sit next to this one
Threat actor
Whoever might attack you, described by capability and motive.
Lateral movement
Moving from the first thing reached to the things worth taking.
MITRE ATT&CK
A public catalogue of the tactics and techniques real attackers use.
Threat hunting
Searching your systems for attackers that alerts have not yet caught.
Supply chain attack
Reaching you through a library, a build tool or a vendor you trust.
Which doors lead to your customers?
A patient attacker looks for the weakest route into a supplier. We find vulnerabilities in your web apps and APIs, including cross-account access flaws, and prove them. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.