Hackers are increasingly targeting businesses of all sizes, especially those that handle proprietary information, such as law firms, accountants, financial entities, defense contractors, medical offices, and government agencies, to steal their classified data.
The term advanced persistent threat (APT) originally referred to nation-states engaging in cyber espionage, but cybercriminals are now using APT techniques to steal data from businesses for financial gain. What sets an APT apart from the rest of the pack of malware, ransomware, and other assorted types of network viruses is that an APT is targeted, persistent, evasive, and advanced.
Let’s take a closer look at APT and how they progress to ensure your business understands the importance of having a robust layered cybersecurity defense that's capable of stopping an APT before it infiltrates your network.
What is an Advanced Persistent Threat (APT)?
The National Institute of Standards and Technology (NIST) defines an advanced persistent threat as:
“An adversary with sophisticated levels of expertise and significant resources, allowing it through the use of multiple different attack vectors (e.g., cyber, physical, and deception), to generate opportunities to achieve its objectives which are typically to establish and extend its presence within the information technology infrastructure of organizations for purposes of continually exfiltrating information.”
Basically, it is a long, sustained, and covert cyber attack against a specific enterprise that aims to pilfer high-value data including but not limited to:
- Military intelligence
- Patent information
- Blueprints
- Legal contracts
- Insider financials
- Medical records
Unlike phishing attacks, where hackers send out large numbers of infected emails hoping to trap random victims, an APT assault seeks out one high-value target and looks for vulnerabilities within the target’s network infrastructure. Once a vulnerability is found and leveraged, the advanced persistent threat will continue to adapt and evolve around the victim’s cybersecurity defenses.
What are the Five Stages of an Advanced Persistent Threat (APT) Attack?
APTs progress in five stages over a period of time to avoid detection. From reconnaissance to exfiltration, here is a breakdown of each advanced persistent threat phase.
1. Reconnaissance
In this initial phase, the hacker leverages information from a variety of factors to understand their target. Hackers have become very sophisticated and sometimes use the information garnered from company websites, social media, and other sources to pinpoint their attacks on specific individuals within an organization.
2. Incursion
Once inside their victim’s network, hackers deliver targeted malware to vulnerable systems and employees. An APT is initiated using various types of attack vectors including social engineering, spear phishing, credential theft, or a drive-by download.
3. Discovery
During the discovery stage, hackers stay low and operate patiently to avoid detection. They then map the organization’s cybersecurity defenses from inside the network, create an attack plan, and deploy multiple parallel attack channels including a channel for remote access.
These parallel attack channels create a backdoor into the victim’s IT infrastructure for future exfiltration of data. During this phase, an APT can also escalate access privileges to gain access to resources that are normally restricted.
4. Capture
Hackers access unprotected systems and capture data over an extended period. During this time, the victim is unknowing of the attack, giving the hacker time to install malware. APT will install malware to capture sensitive business information including, emails, documents, designs, intellectual property, or source code.
5. Exfiltration
At this stage, an APT will wait until there is a viable opportunity to send captured information back to the hacker’s control center for analysis and perhaps further exploitation and fraud. Captured data may be sent through compromised servers or be encrypted to make it more difficult to identify the stolen information and mask where it is going.
Prevent APTs with a Layered Cybersecurity Strategy
As cyber attacks become more sophisticated, companies of all sizes must be able to recognize APT attacks and be prepared to implement rigorous security measures capable of early detection. Businesses that implement a layered cybersecurity strategy coupled with thorough and consistent employee cybersecurity training can reduce their attack surface and help prevent sophisticated advanced persistent threats.
Fortifying your business network doesn't have to be difficult, no matter how sophisticated the tools of cybercriminals have become. The good news is that businesses are never alone in their battle for cybersecurity. Experienced business IT specialists are here to design and implement a multi-pronged cybersecurity strategy that will proactively detect and protect against all forms of cybersecurity threats facing your business.
Editor’s Note: This post was originally published on November 6, 2014, and has been updated for accuracy and current best practices.
