Advanced persistent threat

An advanced persistent threat (APT) is a stealthy <a href="/facts/Threat_actor/7MMDYfDb">threat actor</a>, typically a <a href="/facts/State_(polity)/7ggBzTSk">state</a> or state-sponsored group, which gains unauthorized access to a <a href="/facts/Computer_network/3w5RM99p">computer network</a> and remains undetected for an extended period. In recent times, the term may also refer to non-state-sponsored groups conducting large-scale targeted intrusions for specific goals.
Such threat actors' motivations are typically political or economic. Every major <a href="/facts/Business_sector/UVySRfXc">business sector</a> has recorded instances of <a href="/facts/Cyberattack/6PSQzq7y">cyberattacks</a> by advanced actors with specific goals, whether to steal, spy, or disrupt. These targeted sectors include government, <a href="/facts/Arms_industry/A8mywI9w">defense</a>, <a href="/facts/Financial_services/azqCQelN">financial services</a>, <a href="/facts/Practice_of_law/usFjsEAK">legal services</a>, <a href="/facts/Manufacturing/3qW7bcdy">industrial</a>, <a href="/facts/Telecommunication/vxoj1cxR">telecoms</a>, <a href="/facts/Final_good/a4c3onQ8">consumer goods</a> and many more. Some groups utilize traditional <a href="/facts/Espionage/oaDJ5fAd">espionage</a> vectors, including <a href="/facts/Social_engineering_(security)/7obTw773">social engineering</a>, <a href="/facts/Human_intelligence_(intelligence_gathering)/1QlDb5jn">human intelligence</a> and <a href="/facts/Infiltration_tactics/dIYHke3w">infiltration</a> to gain access to a physical location to enable network attacks. The purpose of these attacks is to install custom <a href="/facts/Malware/5ee7TLFR">malware</a>.
APT attacks on <a href="/facts/Mobile_device/cNS1Rhvg">mobile devices</a> have also become a legitimate concern, since attackers are able to penetrate into cloud and mobile infrastructure to eavesdrop, steal, and tamper with data.
The median "dwell-time", the time an APT attack goes undetected, differs widely between regions. <a href="/facts/FireEye/yekW8oGy">FireEye</a> reported the mean dwell-time for 2018 in the <a href="/facts/Americas/hEuUTL4K">Americas</a> as 71 days, <a href="/facts/Europe%2c_the_Middle_East_and_Africa/9VFa2YMm">EMEA</a> as 177 days, and <a href="/facts/Asia-Pacific/dXT0GTGR">APAC</a> as 204 days. Such a long dwell-time allows attackers a significant amount of time to go through the attack cycle, propagate, and achieve their objectives.

Advanced persistent threat open-in-new

Advanced persistent threat