Advanced Persistent Threat (APT)

NIST describes an APT as an adversary that uses multiple attack vectors, such as cyber, physical, and deception, to create opportunities to reach its objectives. Those objectives typically include establishing and extending footholds in the IT infrastructure of targeted organizations to exfiltrate information, to undermine or impede critical aspects of a mission, program, or organization, or to position itself to do so in the future.

Persistence sets an APT apart. It pursues its objectives repeatedly over an extended period, adapts to defenders' efforts to resist it, and is determined to maintain the level of interaction it needs. CISA notes that an APT often spends a lot of time learning about its target before an intrusion, aiming for an undetected presence in the target's network so it can surveil the target or steal sensitive data over a prolonged period.

The term is generally used for well-resourced, state-sponsored groups whose activity is often targeted and aimed at prolonged network or system intrusion. Industry and government track these actors as named activity clusters. MITRE ATT&CK maps each group to its publicly reported technique use and the software it is reported to use, a subset limited to what open source reporting covers.

Because an attacker with enough time and resources may eventually get in, NCSC guidance advises organizations to detect breaches as soon as possible and to put internal security controls in place that reduce the damage an attacker can do after a breach.