Advanced Persistent Threats (APTs)

APT Characteristics & Attribution

# What makes an attack "Advanced Persistent"?

ADVANCED:
  - Custom malware developed specifically for the target
  - Zero-day exploits — vulnerabilities unknown to the vendor
  - Living-off-the-land (LOLBins): use legitimate OS tools
    (PowerShell, WMI, certutil) rather than custom malware
  - Anti-forensics: timestomping, log deletion, encrypted C2

PERSISTENT:
  - Dwell time: Average 197 days before detection (Mandiant M-Trends)
  - Multiple persistence mechanisms: registry, scheduled tasks, WMI subscriptions
  - Backup access paths in case primary is discovered
  - Move slowly to avoid triggering behavioral analytics

THREAT (targeted, motivated):
  - Specific objective: intellectual property, military intelligence, financial gain
  - Patient: will wait for the right opportunity (spear phish during acquisitions)
  - Resourced: dedicated team, 24/7 operations

# Notable APT Groups (MITRE ATT&CK naming):
APT29 (Cozy Bear / Russia): SolarWinds supply chain attack
APT41 (China): Dual espionage + financial crime
Lazarus (North Korea): Sony hack, WannaCry, $625M Ronin Bridge theft
FIN7 (Criminal): Hospitality, restaurant payment card theft

APT Kill Chain — Real-World Example: SolarWinds

• Phase 1 — Initial Access: Supply chain compromise — malicious code inserted into SolarWinds Orion software update. 18,000 organizations downloaded and installed the trojanized update (including US Treasury, State Department, DHS, Microsoft)
• Phase 2 — Execution: SUNBURST backdoor dormant for 12-14 days after install (to avoid sandbox timeout detection). Checked system name, running processes, and network connections before activating
• Phase 3 — Persistence: DLL side-loading into legitimate SolarWinds process. Disguised C2 communication as Orion API traffic — blended with legitimate software traffic
• Phase 4 — Command & Control: Used compromised Orion infrastructure's legitimate traffic patterns. DNS-based C2 with DGA (domain generation algorithm) — dynamic subdomains of avsvmcloud.com
• Phase 5 — Lateral Movement: Targeted specifically: Microsoft 365, on-premises AD, high-value targets within each victim org. Used SAML token forgery (GoldenSAML) to impersonate any user without their password
• Phase 6 — Objectives: Accessed email of senior government officials. Exfiltrated source code from technology companies. Dwell time: March 2020 → December 2020 (9 months undetected)

Defending Against APTs

• Assume breach mindset — design security assuming a sophisticated attacker is already inside the network
• Privileged access workstations (PAWs) — dedicated, hardened machines for administrative tasks, separate from daily-use workstations
• Canary tokens and tripwires — fake credentials, documents, and DNS names that alert when accessed (attacker reconnaissance)
• Memory-resident malware detection — fileless malware (PowerShell scripts in registry) is invisible to traditional AV; require EDR with behavioral detection
• MITRE ATT&CK-aligned detection — build detection rules covering ATT&CK techniques, not just known malware signatures

Common Mistakes

• Believing perimeter security alone stops APTs — APTs specialize in trusted-channel intrusion (phishing, supply chain, insider threat); assume the perimeter will be breached
• Over-relying on signature-based detection — APT malware is custom and signature-unknown; behavioral and anomaly detection are essential
• Ignoring supply chain security — the SolarWinds attack demonstrated that perfectly secured organizations were compromised through a trusted software vendor

Tip

Practice Task

Quick Quiz

Common Mistake