advanced persistent threat
-
What is an advanced persistent threat (APT) in information technology?
An advanced persistent threat (APT) is a prolonged cyberattack targeting a nation's information assets that are vital to national security or economic interests. APTs use methods that are hard to detect by regular intrusion detection systems. The goal of an APT is to gain a strategic advantage on an international scale rather than just financial or political gains. These attacks, which can last for months or years, aim to steal or destroy important knowledge.
Spear phishing and zero-day malware are common attack methods. Zero-day malware is harmful software that isn't detectable by antivirus programs yet, while spear phishing uses emails that appear to be from trusted sources to trick specific employees into letting hostile programs into their computers.
2 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
How are APTs different from regular computer viruses or malware?
Advanced persistent threats (APTs) differ from regular computer viruses or malware through their focus, stealth, and persistence. APTs target specific entities, often of national security or economic strategic importance, with the aim of gaining a strategic advantage rather than mere financial gain or making a political statement.
APTs use methods like spear phishing and zero-day malware to infiltrate systems, often remaining undetected for extended periods. Unlike common hacking tools, APTs employ sophisticated software and maintain a low profile to evade intrusion detection systems. The persistence of APTs, sometimes lasting months or years, distinguishes them from typical malware attacks.
1 Britannica SourceCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
What are some common goals of attackers who use APTs?
Advanced persistent threats (APTs) are stealthy cyberattacks aimed at gaining a strategic advantage in the international arena, rather than mere financial or political gains. APTs target industrial, economic, or governmental organizations to steal or destroy knowledge of international military and economic importance. Common targets include government agencies, defense contractors, and industries developing technologies of military or economic strategic importance, such as aerospace and computer companies. Specific items for data exfiltration include email archives, documents, intellectual property containing trade secrets, and databases containing classified or proprietary information.
1 Britannica SourceCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
How do advanced persistent threats usually infiltrate computer systems?
Advanced persistent threats (APTs) infiltrate computer systems through methods like spear phishing, which uses targeted emails to trick employees into letting hostile programs enter their computers. These emails often appear to be from trusted sources, persuading individuals to click on links or lower their guard. Attackers also use zero-day malware, which is hostile software undetectable by antivirus programs. Discovering an APT involves monitoring network traffic to identify communications between the botnet master and the implanted malware. Social engineering, including phishing, is also used to gain valuable information or system access.
3 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
What techniques do attackers use to stay hidden when conducting an APT?
To stay hidden, attackers conducting an advanced persistent threat (APT) employ techniques that minimize their visibility to intrusion detection systems. These attacks are stealthy and may use sophisticated software.
Common methods include spear phishing and the distribution of zero-day malware. Once inside a system, APTs operate below the detection level of intrusion-detection systems. They may also use rootkits, malware designed to stay hidden and grant unauthorized access to a computer.
3 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles. -
How can organizations detect and defend against advanced persistent threats?
To detect and defend against advanced persistent threats (APTs), organizations can closely monitor network traffic to identify communications between botnet masters and implanted malware, which exposes the compromise. Ensuring all software is up-to-date and avoiding unknown links can effectively prevent cyberattacks.
Organizations can educate employees on cybersecurity, enlist third-party security experts, or invest in an internal cybersecurity team. These teams can find system weaknesses, detect cyberattacks, and create response plans. Identity and access management strategies, such as multifactor authentication, strong passwords, and virtual private networks, provide added security. Firewalls and internet encryption can prevent bad actors from interacting with a network, and data loss prevention tools can monitor security threats and back up important data in case of a breach.
2 Britannica SourcesCreated from Britannica articles using AI. AI can make mistakes, so verify using Britannica articles.
advanced persistent threat (APT), attacks on a country’s information assets of national security or strategic economic importance through either cyberespionage or cybersabotage. These attacks use technology that minimizes their visibility to computer network and individual computer intrusion detection systems. APTs are directed against specific industrial, economic, or governmental targets to acquire or to destroy knowledge of international military and economic importance. (Stuxnet, for example, would fall under this definition as an APT directed against Iran.) Once an APT has entered its target, the attack can last for months or years; that is, it is a “persistent” threat. The motive behind the threat goes beyond mere political or financial gain. An APT is not hacktivism—that is, penetrating a Web site or network to make a political statement—nor is it strictly cybercrime, where the perpetrators steal information for profit alone. Rather, the aim is to gain strategic or tactical advantage in the international arena.
The term advanced persistent threat originated in the U.S. Department of Defense late in the first decade of the 21st century to describe cyberespionage efforts by China against American national security interests. Attacks in 2009 against the search engine company Google and in 2011 against RSA, the security division of the information technology company EMC Corporation, brought the concept into discussions within the commercial information security community. Some authorities in that community advocated expanding the concept to include any sophisticated hacking campaign conducted against a large organization. However, other authorities strictly defined an APT as an attack on national security interests, arguing that to define it otherwise would admit almost any cyberattack as an APT and thus limit the definition’s value in developing specific countermeasures.
Common targets of APTs include government agencies, defense contractors, and industries developing technologies of military or economic strategic importance, such as aerospace and computer companies. Specific items for data exfiltration (the stealing of knowledge) include e-mail archives, document stores, intellectual property containing trade secrets, and databases containing classified or proprietary information. Examples of targeted documents are product designs, supplier lists, research lab notes, and testing results.
" height="20" alt="HEW Logo">
Methods of attack include “spear phishing” and the distribution of “zero-day malware.” Spear phishing uses e-mails sent to selected employees within an organization. The e-mails appear to come from trusted or known sources. Either by clicking on links within the e-mail or by being persuaded by the e-mail’s seeming legitimacy to let their guard down, these employees let hostile programs enter their computers. Zero-day malware is hostile computer software, such as viruses or Trojan horses, that is not yet detectable by antivirus programs. Networks of already compromised computers, known as “botnets,” distribute these zero-day attacks. Neither of the methods is new, and they are not exclusive to APTs. Their use against national security assets, however, is indicative of an APT attack rather than conventional hacking.
APT attacks are by nature stealthy and may use software that is more sophisticated than common “off-the-shelf” hacking tools found on the Internet. Their footprint on a computer or network is relatively small, and APTs try to operate below the detection level of an intrusion-detection system. Discovering the APT, however, is still possible through close monitoring of traffic on a network. Identifying communications between the botnet master (the control point) and the implanted malware reveals the compromise. This need for command-and-control activity remains the Achilles’ heel of APTs.