How Advanced Persistent Threat Works
Mostly nation-state-sponsored attacks aimed at compromising an organisation to carry out espionage or sabotage goals, but which aim to remain undetected for a longer period of time.
The term Advanced Persistent Threat (APT) is often misused. Rather than a specific technical approach to an attack or network threat, it is meant to describe the attacker (or group of attackers) and the attacker’s motivations behind the threat they pose, which are not simply one-time espionage, financial gain, and crime.
Advanced Persistent Threats (APTs) are either motivated by corporate espionage designed to steal valuable trade secrets and intellectual property, or to sabotage an organisation's plans and infrastructure.
Advanced Persistent Threat Characteristics
Advanced Persistent Threat attackers use a variety of email-based techniques to create attacks, including email spoofing and phishing, supported by other physical and external exploitation techniques. There are some typical characteristics of an Advanced Persistent Threats that are not found in other forms of attack:
- Recon: Advanced Persistent Threat attackers typically have reconnaissance intelligence and know who the specific user targets and what the systems are that can help them achieve their goals. This information is often gleaned through social engineering, public forums and, most likely, nation-state security intelligence.
- Time-to-live: Advanced Persistent Threat attackers employ techniques to avoid detection for extended periods of time, not just looking for a short-lived infection period that is typically seen in financial gain motivated attacks. They attempt to clean up their trail and usually perform their functions during non-business hours. They always leave backdoors so they can re-enter, just in case their original access is detected. This allows them to remain persistent.
- Advanced Malware: Advanced Persistent Threat attackers use the full spectrum of known and available intrusion techniques, and in any given attack combine a number of methodologies to reach their goal. Advanced Persistent Threat attackers do make use of commercially available crimeware and kits, but many also typically have the technology and expertise to create their own custom tools and polymorphic malware when required for customised environments and systems.
- Phishing: Most Advanced Persistent Threats, employing internet-driven exploitation techniques start with social engineering and spear-phishing. Once a user machine is compromised or network credentials are given up, the attackers actively take steps to deploy their own tools to monitor and spread through the network as required, from machine-to-machine, and network-to-network, until they find the information they are looking for.
- Active Attack: In Advanced Persistent Threats there is a significant level of coordinated human involvement from the attacker, rather than fully automated malicious code which just sends back data collected to the attacker in typical crimeware attacks. The adversary in this case is a well-funded, motivated, skilled, and highly directed attacker making their approach and response extremely active.
How can I protect against Advanced Persistent Threats?
There is no one silver bullet for APT protection or deterring APT threat actors. These advanced persistent threats and the attackers are looking to remain persistent once they are inside the organisation, so utilising a combination of technologies that can triangulate logs and identify out-of-norm behaviour within the enterprise network is key. The focus of the APT defence strategy should be to pick best-in-class detection solutions that together can provide intelligence on the targets, the methods used by the attackers, the frequency of their activity, the origination of the advance persistent threat, and the risk associated with the attacker’s motives. Learn how Proofpoint's Advanced Threat Protection can help.
Based on the Verizon Data Breach Investigations Report, 95% of targeted threats and APTs using some form of spear phishing as a starting point of the attack, and hence a part of APT defence strategy for an enterprise should include a detection solution that attempts to look for targeted threats in email based on unusual patterns in traffic, rewrites the embedded URLs in suspicious emails, and then maintains a constant watch on the URL for malicious behaviour in a sandbox. Such an approach would potentially protect and/or detect such attacks, and knowing which users have been compromised, when, and for how long is a major advantage in learning more about the APT adversary and their motivations.
Download the Advanced Threat Protection Solution Brief
Proofpoint Advanced Threat Solutions protects critical information and equips you with the right intelligence and tools to respond quickly when things go wrong.
Download the Proofpoint Essentials Threat Protection Solution Brief
Proofpoint Essentials–Threat Protection is a cost-effective and easy-to-manage security bundle designed for small to midsize businesses (SMBs).
Download the Advanced Threat Vector Infographic
The greatest threat to an organisation is sitting in its employee inboxes.
Analysts Report: Protecting Against Advanced Threats and Compliance Risks
Today’s workers have gone beyond the network, using multiple devices to conduct business, anywhere, any time. How can you protect your business today?