Advanced persistent threat

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below: • Advanced – Operators behind the threat have a full spectrum of intelligence-gathering techniques at their disposal. These may include commercial and open source computer intrusion technologies and techniques, but may also extend to include the intelligence apparatus of a state. While individual components of the attack may not be considered particularly "advanced" (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools, and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from "less advanced" threats. • Persistent – Operators have specific objectives, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task. • Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code. The operators have a specific objective and are skilled, motivated, organized and well funded. Actors are not limited to state sponsored groups. ==History and targets==

Warnings against targeted, socially-engineered emails dropping trojans to exfiltrate sensitive information were published by UK and US CERT organisations in 2005. This method was used throughout the early 1990s and does not in itself constitute an APT. The term "advanced persistent threat" has been cited as originating from the United States Air Force in 2006 with Colonel Greg Rattray cited as the individual who coined the term. The Stuxnet computer worm, which targeted the computer hardware of Iran's nuclear program, is one example of an APT attack. In this case, the Iranian government might consider the Stuxnet creators to be an advanced persistent threat. Within the computer security community, and increasingly within the media, the term is almost always used in reference to a long-term pattern of sophisticated computer network exploitation aimed at governments, companies, and political activists, and by extension, also to ascribe the A, P and T attributes to the groups behind these attacks. Advanced persistent threat (APT) as a term may be shifting focus to computer-based hacking due to the rising number of occurrences. PC World reported an 81 percent increase from 2010 to 2011 of particularly advanced targeted computer attacks. Actors in many countries have used cyberspace as a means to gather intelligence on individuals and groups of individuals of interest. The United States Cyber Command is tasked with coordinating the US military's offensive and defensive cyber operations. Numerous sources have alleged that some APT groups are affiliated with, or are agents of, governments of sovereign states. Businesses holding a large quantity of personally identifiable information are at high risk of being targeted by advanced persistent threats, including: • Agriculture • Energy • Financial institutions • Health care • Higher education • Manufacturing • Technology • Telecommunications • Transportation A Bell Canada study provided deep research into the anatomy of APTs and uncovered widespread presence in Canadian government and critical infrastructure. Attribution was established to Chinese and Russian actors. == Life cycle ==

Actors behind advanced persistent threats create a growing and changing risk to organizations' financial assets, intellectual property, and reputation by following a continuous process or kill chain: • Target specific organizations for a singular objective • Attempt to gain a foothold in the environment (common tactics include spear phishing emails) • Use the compromised systems as access into the target network • Deploy additional tools that help fulfill the attack objective • Cover tracks to maintain access for future initiatives In 2013, Mandiant presented results of their research on alleged Chinese attacks using APT method between 2004 and 2013 that followed similar lifecycle: • Initial compromiseperformed by use of social engineering and spear phishing, over email, using zero-day viruses. Another popular infection method was planting malware on a website that the victim's employees will be likely to visit. • Establish footholdplant remote administration software in victim's network, create net backdoors and tunnels allowing stealth access to its infrastructure. • Escalate privilegesuse exploits and password cracking to acquire administrator privileges over victim's computer and possibly expand it to Windows domain administrator accounts. • Internal reconnaissancecollect information on surrounding infrastructure, trust relationships, Windows domain structure. • Move laterallyexpand control to other workstations, servers and infrastructure elements and perform data harvesting on them. • Maintain presenceensure continued control over access channels and credentials acquired in previous steps. • Complete missionexfiltrate stolen data from victim's network. In incidents analysed by Mandiant, the average period over which the attackers controlled the victim's network was one year, with longest – almost five years. Previous reports from Secdev had previously discovered and implicated Chinese actors. == Mitigation strategies ==

There are tens of millions of malware variations, which makes it extremely challenging to protect organizations from APT. While APT activities are stealthy and hard to detect, the command and control network traffic associated with APT can be detected at the network layer level with sophisticated methods. Deep log analyses and log correlation from various sources is of limited usefulness in detecting APT activities. It is challenging to separate noises from legitimate traffic. Traditional security technology and methods have been ineffective in detecting or mitigating APTs. Active cyber defense has yielded greater efficacy in detecting and prosecuting APTs (find, fix, finish) when applying cyber threat intelligence to hunt and adversary pursuit activities. Human-Introduced Cyber Vulnerabilities (HICV) are a weak cyber link that are neither well understood nor mitigated, constituting a significant attack vector. == APT groups ==

China • PLA Unit 61398 (also known as APT1) • PLA Unit 61486 (also known as APT2) • Buckeye (also known as APT3) • Red Apollo (also known as APT10) • Numbered Panda (also known as APT12) • APT15 (also known as Vixen Panda or Ke3chang) • DeputyDog (also known as APT17) • Dynamite Panda or Scandium (also known as APT18, a unit of the People's Liberation Army Navy) • Codoso Team (also known as APT19) • Wocao (also known as APT20) • APT22 (aka Suckfly) • APT26 (aka Turbine Panda) • APT 27 • PLA Unit 78020 (also known as APT30 and Naikon) • Zirconium (also known as APT31, Violet Typhoon, or the Wuhan Xiaoruizhi Science and Technology Company) • APT40 • Double Dragon (also known as APT41, Winnti Group, Barium, or Axiom) • Spamouflage (also known as Dragonbridge or Storm 1376) • Hafnium • LightBasin (Also known as UNC1945) • Tropic Trooper • Volt Typhoon • Flax Typhoon • Charcoal Typhoon (also known as CHROMIUM) • Salmon Typhoon (also known as SODIUM) • Liminal Panda • MirrorFace • Mustang Panda (also known as UNC6384) • UNC3886 • Phantom Taurus • UNC2814 Pakistan • Gorgon Group • Transparent Tribe (also known as APT36) • Operation C-Major • ReverseRat • SideCopy Iran • Charming Kitten (also known as APT35) • Elfin Team (also known as APT33) • Helix Kitten (also known as APT34) • Pioneer Kitten • Remix Kitten (also known as APT39, ITG07, or Chafer) • MuddyWater North Korea • Kimsuky (also known as APT43) • Lazarus Group (also known as APT38) • Ricochet Chollima (also known as APT37) Russia • Berserk Bear • Cozy Bear (also known as APT29) • Fancy Bear (also known as APT28) • FIN7 • Gamaredon (also known as Primitive Bear) • Sandworm (also known as APT44) • Venomous Bear Turkey • StrongPity (also known as APT-C-41 or PROMETHIUM) United States • Equation Group Uzbekistan • SandCat, associated with the State Security Service according to Kaspersky Vietnam • OceanLotus (also known as APT32) India • APT-C-35 • Appin • Bahamut • Confucius • Hangover Group • ModifiedElephant • Patchwork (Dark Samurai) • SideWinder • Scybers • Urpage ==Naming==

Multiple organizations may assign different names to the same actor. As separate researchers could each have their own varying assessments of an APT group, companies such as CrowdStrike, Kaspersky, Mandiant, and Microsoft, among others, have their own internal naming schemes. Names between different organizations may refer to overlapping but ultimately different groups, based on various data gathered. CrowdStrike assigns animals by nation-state or other category, such as "Kitten" for Iran and "Spider" for groups focused on cybercrime. Other companies have named groups based on this system Rampant Kitten, for instance, was named by Check Point rather than CrowdStrike. Dragos bases its names for APT groups on minerals. == See also ==