APTs concept

APTs are different from other targeted attacks in the following ways:

Customized attacks: Advanced Persistent Threats (APTs) frequently use highly customized methods, tools and access gaining techniques. These techniques are developed specifically for a particular purpose or campaign. These tools include viruses, zero-day vulnerability exploits, rootkits and worms.

In addition, APTs often launch series of threats or “kill chains” continuously to attack their targets and ensure continuing access to targeted computers, sometimes including a "sacrificial" threat to trick the target into thinking the attack has been successfully repelled. The objective of Cyber Kill Chains is to enhance visibility into an attack and enrich an analyst’s understanding of an adversary’s tactics, techniques and procedures. The Cyber Kill Chain framework is part of the Intelligence Driven Defense model for the identification of attack.

Low and slow: Advanced Persistent Threat attacks occur over long tenure during which the attacker moves slowly and secretly to avoid detection. It is opposite to the faster tactics of many attacks launched by typical hackers or cyber-criminals. The main objective of APT is to stay undetected or in a stealth mode. It moves slowly with continuous monitoring and low interaction till the attackers fulfill their defined objectives.

Higher aspirations: Advanced Persistent Threats are designed to fulfill the requirements of international sabotage or espionage, usually involving covert state actors. The objective of an APT may include military secrecy breach, political agenda, or economic intelligence gathering, confidential data or trade secret threat, disruption of operations of any important department, or even destruction of equipment. Groups behind APTs are well funded and staffed; they may operate with the support of military or state intelligence.

Specific targets: While any large organization possessing intellectual property or valuable customer information is susceptible to targeted attacks, APTs are aimed at a much smaller range of targets. Most of the reported APT attacks have been launched at Government agencies, contractors of the Defence department and manufacturers of products that are highly competitive and in demand on global markets. But government related manufacturers and organizations are not the only targets. Ordinary companies with valuable and advanced technology or intellectual property are now targeted by nation states. Along with this, APTs may attack vendor or partner organizations of their targets.