Advanced persistent threat

An advanced persistent threat (APT) is a set of stealthy and continuous computer hacking processes, often orchestrated by human(s) targeting a specific entity. APT usually targets organizations and/or nations for business or political motives. APT processes require a high degree of covertness over a long period of time. The "advanced" process signifies sophisticated techniques using malware to exploit vulnerabilities in systems. The "persistent" process suggests that an external command and control system is continuously monitoring and extracting data from a specific target. The "threat" process indicates human involvement in orchestrating the attack.^[1]

APT usually refers to a group, such as a government, with both the capability and the intent to target, persistently and effectively, a specific entity. The term is commonly used to refer to cyber threats, in particular that of Internet-enabled espionage using a variety of intelligence gathering techniques to access sensitive information,^[2] but applies equally to other threats such as that of traditional espionage or attacks.^[3] Other recognized attack vectors include infected media, supply chain compromise, and social engineering. The purpose of these attacks is to place custom malicious code on one or multiple computers for specific tasks and to remain undetected for the longest possible period. Knowing the attacker artifacts, such as file names, can help a professional make a network-wide search to gather all affected systems.^[4] Individuals, such as an individual hacker, are not usually referred to as an APT, as they rarely have the resources to be both advanced and persistent even if they are intent on gaining access to, or attacking, a specific target.^[5]

History and targets

First warnings against targeted, socially-engineered emails dropping trojans to exfiltrate sensitive information were published by UK and US CERT organisations in 2005, although the name "APT" was not used.^[6] The term "advanced persistent threat" is widely cited as originating from the United States Air Force in 2006^[7] with Colonel Greg Rattray frequently cited as the individual who coined the term.^[8]

The Stuxnet computer worm, which targeted the computer hardware of Iran's nuclear program, is one example. In this case, the Iranian government might consider the Stuxnet creators to be an advanced persistent threat.

Within the computer security community, and increasingly within the media, the term is almost always used in reference to a long-term pattern of sophisticated hacking attacks aimed at governments, companies, and political activists, and by extension, also to refer to the groups behind these attacks. Advanced persistent threat (APT) as a term may be shifting focus to computer based hacking due to the rising number of occurrences. PC World reported an 81 percent increase from 2010 to 2011 of particularly advanced targeted computer hacking attacks.^[9]

A common misconception associated with the APT is that the APT only targets Western governments. While examples of technological APTs against Western governments may be more publicized in the West, actors in many nations have used cyberspace as a means to gather intelligence on individuals and groups of individuals of interest.^[10][11][12] The United States Cyber Command is tasked with coordinating the US military's response to this cyber threat.

Numerous sources have alleged that some APT groups are affiliated with, or are agents of, nation-states.^[13][14][15] Businesses holding a large quantity of personally identifiable information are at high risk of being targeted by advanced persistent threats, including:^[2]

• Higher education^[16]
• Financial institutions

APT characteristics

Bodmer, Kilger, Carpenter and Jones defined the following APT criteria:^[17]

• Objectives – The end goal of the threat, your adversary
• Timeliness – The time spent probing and accessing your system
• Resources – The level of knowledge and tools used in the event (skills and methods will weigh on this point)
• Risk tolerance – The extent the threat will go to remain undetected
• Skills and methods – The tools and techniques used throughout the event
• Actions – The precise actions of a threat or numerous threats
• Attack origination points – The number of points where the event originated
• Numbers involved in the attack – How many internal and external systems were involved in the event, and how many people's systems have different influence/importance weights
• Knowledge source – The ability to discern any information regarding any of the specific threats through online information gathering (you might be surprised by what you can find by being a little proactive)

APT life cycle

Actors behind advanced persistent threats create a growing and changing risk to organizations' financial assets, intellectual property, and reputation^[18] by following a continuous process:

1. Target specific organizations for a singular objective
2. Attempt to gain a foothold in the environment (common tactics include spear phishing emails)
3. Use the compromised systems as access into the target network
4. Deploy additional tools that help fulfill the attack objective
5. Cover tracks to maintain access for future initiatives

The global landscape of APTs from all sources is sometimes referred to in the singular as "the" APT, as are references to the actor behind a specific incident or series of incidents.

In 2013, Mandiant presented results of their research on alleged Chinese attacks using APT methodology between 2004 and 2013^[19] that followed similar lifecycle:

• Initial compromise – performed by use of social engineering and spear phishing, over email, using zero-day viruses. Another popular infection method was planting malware on a website that the victim employees will be likely to visit.
• Establish Foothold – plant remote administration software in victim's network, create network backdoors and tunnels allowing stealth access to its infrastructure.
• Escalate Privileges – use exploits and password cracking to acquire administrator privileges over victim's computer and possibly expand it to Windows domain administrator accounts.
• Internal Reconnaissance – collect information on surrounding infrastructure, trust relationships, Windows domain structure.
• Move Laterally – expand control to other workstations, servers and infrastructure elements and perform data harvesting on them.
• Maintain Presence – ensure continued control over access channels and credentials acquired in previous steps.
• Complete Mission – exfiltrate stolen data from victim's network.

In incidents analysed by Mandiant, the average period over which the attackers controlled the victim's network was one year, with longest – almost five years.^[19] The infiltrations were allegedly performed by Shanghai-based Unit 61398 of People's Liberation Army. Chinese officials have denied any involvement in these attacks.^[20]

Terminology

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:^[3][5][21]

• Advanced – Operators behind the threat have a full spectrum of intelligence-gathering techniques at their disposal. These may include computer intrusion technologies and techniques, but also extend to conventional intelligence-gathering techniques such as telephone-interception technologies and satellite imaging. While individual components of the attack may not be classed as particularly "advanced" (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools, and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from "less advanced" threats.

• Persistent – Operators give priority to a specific task, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.

• Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code. The operators have a specific objective and are skilled, motivated, organized and well funded.

Mitigation strategies

There are hundreds of millions of malware variations, which makes it extremely challenging to protect organizations from APT. While APT activities are stealthy and hard to detect, the command and control network traffic associated with APT can be detected at the network layer level. Deep log analyses and log correlation from various sources can be useful in detecting APT activities. Agents can be used to collect logs (TCP and UDP) directly from assets into a syslog server. Then a Security Information and Event Management (SIEM) tool can correlate and analyze logs. While it is challenging to separate noises from legitimate traffic, a good log correlation tool can be used to filter out the legitimate traffic, so security staff can focus on the noises.^[1] Gartner has published a best practices document for mitigating advanced persistent threats. A good asset management with documented components of the original Operation System plus software will help IT security analysts detect new files on the system.

See also

• Advanced volatile threat
• Cyber spying
• Darkhotel
• Operation Aurora
• Operation Shady RAT
• PLA Unit 61398
• Spear-phishing
• Spy-phishing
• Tailored Access Operations
• Principle of least privilege

References

^[1] Best Practices for Mitigating Advanced Persistent Threats - http://sites.miis.edu/cysec/files/2014/01/Best-Practices-for-Mitigating-Advanced-Persistent-Threats.pdf

Further reading

• http://www.theregister.co.uk/2013/03/01/post_cryptography_security_shamir
• Gartner: Strategies for Dealing With Advanced Targeted Attacks
• APT Malware search software
• APT Malware notes sorted by year
• Best Practices for Mitigating Advanced Persistent Threats

1. ↑ Gartner