APTs

What is an Advanced Persistent Threat (APT)?

APTs, or Advanced Persistent Threats, refer to highly coordinated cyberattacks conducted by skilled threat actors, often with significant resources at their disposal. These can be state-sponsored groups, advanced criminal organizations, or other entities capable of executing complex and targeted attacks.

Here’s why an APT is said to be advanced and persistent:

• Advanced: The attackers have sophisticated levels of expertise and use a range of techniques and tools, some of which may be custom-built. This includes utilizing zero-day vulnerabilities, advanced malware, and other high-level techniques.
• Persistent: Unlike smash-and-grab attacks that are over quickly, APTs often remain in the target’s system for an extended period. This persistence allows them to carry out their objectives over time, such as stealing information or laying the groundwork for future attacks.

What are the Techniques in APT Attacks?

Zero-day exploits

Zero-day exploits are previously unknown vulnerabilities in software or hardware that can be exploited before a patch is available. These exploits are highly valuable to APT groups and can be used to gain initial access to a target network. Once inside, the APT groups can use the exploit to move laterally and establish a foothold.

Supply chain attacks

Supply chain attacks involve compromising a third-party vendor or supplier to gain access to a target organization. Supply chain attacks are particularly difficult to detect because they use a legitimate entry point into the target organization.

Watering hole attacks

Watering hole attacks involve compromising a target such as a website or network asset that is frequently visited by employees of a target organization. This can be done by exploiting vulnerabilities or by injecting malware into the target. When an employee visits the compromised target, the malware is downloaded and installed on their device, providing the APT with a foothold in the network.

Spear phishing

Spear phishing is a targeted form of phishing that involves sending highly personalized and convincing emails to specific individuals or groups. These emails often appear to come from a trusted source and contain malware or other malicious attachments. Spear phishing is particularly effective because it is used to target specific individuals or groups, increasing the likelihood of success.

Command-and-control (C&C) servers

C&C servers are used by attackers to communicate with and run commands on compromised devices. These servers can be used to download and install malware, steal sensitive data, or conduct other malicious activities.

Defense evasion approaches

Defense evasion approaches are used by attackers to avoid detection by security software and other defenses. These strategies can include using compromised credentials and using encryption, obfuscation, and other techniques to hide malicious code or data. Defense evasion approaches are particularly effective because they can make it difficult for security teams to detect and respond to APTs.

Credentials compromise

Credentials compromise is a common tactic used by APTs to gain access to a target network. This can be done by stealing login credentials through phishing attacks or by using malware to capture keystrokes and other sensitive data. Credentials compromise is very effective because it can provide attackers with a legitimate entry point into the target network.

How are traditional cyber threats different from APT?

Traditional cyber threats differ from APTs in the following aspects:

• Scope
  Traditional cyber threats typically target a specific system, network, or organization, with a limited scope of attack.
  APTs have a broader scope, often targeting multiple systems, networks, or organizations, with the goal of stealing sensitive information or disrupting operations.
• Sophistication
  Traditional cyber threats typically use automated tools and scripts to exploit vulnerabilities, with a relatively low level of sophistication.
  APTs are highly sophisticated, using custom-built malware and exploiting zero-day vulnerabilities to evade detection. APTs often require significant resources and expertise to develop and execute.
• Targets
  Traditional cyber threats typically target publicly accessible systems or networks, with the goal of stealing sensitive information or disrupting service.
  APTs target specific individuals, organizations, or industries, with the goal of stealing sensitive information, intellectual property, or disrupting operations. APTs often aim for high-value targets, such as government agencies, financial institutions, and healthcare organizations.
• Motivations
  Traditional cyber threats are often motivated by financial gain, such as stealing credit card information or sensitive data.
  APTs are often motivated by political or ideological goals, such as espionage, intellectual property theft, or disruption of critical infrastructure.
• Methods
  Traditional cyber threats typically use automated tools and scripts to exploit vulnerabilities.
  APTs use a range of methods, including spear phishing, zero-day exploits, custom-built malware, watering hole attacks, and supply chain attacks.
• Detection and Response
  Traditional cyber threats can often be detected and responded to using traditional security tools, such as firewalls, intrusion detection systems (IDS), and antivirus software.
  APTs are much more difficult to detect and respond to, requiring advanced threat detection and incident response capabilities. APTs often evade detection for extended periods of time, making it challenging to identify and contain the threat.
• Impact
  Traditional cyber threats can cause significant financial loss, reputational damage, and disruption to business operations.
  APTs can have a much more significant impact, including theft of sensitive information or intellectual property, disruption of critical infrastructure or operations, and long-term damage to an organization’s reputation and trust.
• Persistence
  Traditional cyber threats typically aim to exploit a vulnerability and then move on to the next target.
  APT groups persist on a target system or network for an extended period, often using techniques such as Living off the Land (LotL) and defense evasion through encryption and obfuscation.

Characteristics of an APT attack

The following are the characteristics of an APT attack:

Specific goals and objectives

APT attacks are designed to achieve specific goals, such as stealing sensitive data, disrupting operations, or conducting espionage. The attackers often have a clear understanding of what they want to achieve and will focus their efforts on achieving that goal. This makes it particularly challenging to detect and respond to APT attacks.

Coordinated and well-resourced

APT attacks are typically carried out by well-funded and highly organized groups, often with significant resources and expertise. This coordination and resources enable them to use advanced tactics, techniques, and procedures (TTPs) to evade detection and achieve their goals.

Redundant points of entry

APT attackers often establish multiple points of entry into a target network, allowing them to maintain access even if one point is detected and blocked. This redundancy makes it difficult for defenders to eliminate the threat, as the attackers can simply use another entry point to regain access.

Expensive to carry out

APT attacks are often expensive to carry out, requiring significant resources and expertise. This high cost means that only well-funded and motivated attackers can carry out APT attacks, making them a significant threat to organizations with valuable assets.

Multiple points of compromise

APT attacks often involve multiple points of compromise, such as compromised accounts, malware, and other forms of exploitation. This multiplicity makes it difficult for defenders to identify and respond to the threat, as the attackers can use multiple vectors to maintain access and achieve their goals.

Sequential

APT attacks often involve a series of sequential steps, with each step building on the previous one to achieve the attacker’s goals. This sequential nature makes it difficult for defenders to detect and respond to the threat, as the attackers can use each step to evade detection and maintain access.

Enhanced timeframe

APT attacks often have an extended time frame, with attackers taking weeks, months, or even years to achieve their goals. This extended time frame allows attackers to gather intelligence, establish a foothold, and conduct reconnaissance before launching a full-scale attack.

What are the stages of an attack by an APT group?

An APT attack can be broadly divided into the following stages:

1. Reconnaissance: Gathering information about the target to understand vulnerabilities, systems, network architecture, and so on.
2. Initial exploitation: Gaining a foothold in the system, often through social engineering, exploiting vulnerabilities, or other means.
3. Establishing presence: Installing malware or other tools that allow ongoing access to the system.
4. Privilege escalation: Gaining higher-level access within the system to move freely and access more valuable resources.
5. Data exfiltration: Stealing valuable information, such as intellectual property, personal data, or financial records.
6. Covering tracks: Erasing or altering logs and other traces to avoid detection.
7. Creating avenues for future attacks: In some cases, APT actors might create backdoors or other means of re-entry for future attacks or other strategic purposes.

Typically, APTs are difficult to detect and defend against because of the level of sophistication and the targeted nature of the attacks. They often require a comprehensive, multi-layered defense strategy, along with constant monitoring and collaboration with other organizations to share threat intelligence.

The Cybersecurity and Infrastructure Security Agency (CISA) is a critical component of the US Department of Homeland Security (DHS) responsible for protecting the country’s critical infrastructure and cyber systems from threats, including APTs. CISA’s functions include conducting threat assessments, providing cybersecurity guidance and best practices, and coordinating with other government agencies and private sector organizations to share threat information and coordinate incident response efforts.

CISA also works closely with the Federal Bureau of Investigation (FBI) and other law enforcement agencies to investigate and disrupt APTs and other cyber threats.

CISA’s expertise and resources are essential in helping to detect, disrupt, and prevent APTs, as well as providing guidance and support to organizations that are targeted by these threats.

Examples of Advanced Persistent Threats

The following are some examples of well-known APTs:

• Storm-0558 is a Chinese hacking group that has been active since at least 2020. The group is known for its use of spear-phishing attacks and its ability to steal sensitive data. In July 2023, Microsoft reported that Storm-0558 had breached the email accounts of more than two dozen organizations worldwide, including U.S. and Western European government agencies.
• APT28, also known as Fancy Bear, is a Russia-based cyber espionage group that has been linked to numerous high-profile attacks, including the 2016 US presidential election hack. They are known for their ability to steal sensitive information, including political and military secrets, and have been accused of conducting espionage on behalf of the Russian government. APT28 is believed to be responsible for a wide range of attacks, including phishing campaigns, malware infections, and data breaches.
• Lazarus Group: This is a North Korean APT that is known for its attacks on financial institutions and government organizations.
• MuddyWater: This is an Iranian APT that is known for its attacks on energy companies and other critical infrastructure.

How can Acalvio protect against attacks by APTs

Acalvio ShadowPlex offers the following capabilities to counter APTs:

Security and Identity Posture Management

Acalvio’s Security and Identity Posture Management capabilities offer visibility into the attack surface associated with identities and the corresponding identity repositories. ShadowPlex also enables the reduction of the identity attack surface. This provides a powerful mechanism for defense teams to ensure a proactive security posture.

Threat Detection and Response

Acalvio provides deceptions for detecting APTs and other kinds of cyber threats. These deceptions are designed to look like identities, data, applications, endpoint devices, and network infrastructure elements. Each deception blends in the environment where it is deployed and, at the same time, stands out to APTs. When an adversary tries to interact with a deception, an alert is raised and preconfigured response actions are initiated.

Intelligent SOC for Threat Hunting and Confirmation

Acalvio also provides deceptions and other features that the SOC team can use to test hypotheses about the presence of APTs in the network. These Intelligent SOC capabilities enable the defense teams to actively track down threats, such as APTs, that are suspected to be lurking in the network. Appropriate response actions can be initiated after the threat is confirmed.

Frequently Asked Questions