APT (Advanced Persistent Threat)

APT (Advanced Persistent Threat) is a sophisticated, prolonged cyber attack, usually conducted by well-funded groups (often state-linked) against specific targets: governments, large corporations, critical infrastructure.

APT Characteristics

• Advanced — using 0-day vulnerabilities and sophisticated techniques
• Persistent — attack lasts months or years
• Threat — serious threat with specific goals

Notable APT Groups

• APT28 (Fancy Bear) — Russia
• APT29 (Cozy Bear) — Russia
• APT41 — China
• Lazarus Group — North Korea
• APT33 — Iran

APT Attack Phases

1. Reconnaissance and information gathering
2. Initial compromise
3. Establishing foothold
4. Privilege escalation
5. Lateral movement
6. Data exfiltration