Characteristics of Advanced Persistent Threat (APT)

What is Advanced Persistent Threat? 

APT is the term where an attack in which the intruder gains access to the network & remains undetected for a long period to mine the sensitive data.

APT attacks are mainly aimed at Government organizations, National defences, manufacturing & financial industries & large enterprises as those companies mostly deal with highly sensitive data including intellectual & other government & enterprise data.

APT groups use advanced attack techniques including Phishing attacks, Social engineering, and Zero-day vulnerabilities exploits. To remain undetected in the network they use file-less malware & continually changing malware codes for evasion techniques.

Phases of Advanced Persistent Threat Attack

For better cybersecurity improvement we need to understand how APT works, below are the Phases of Advanced Persistent Threat attack

Phase 1: Infiltration into the network

APT groups gain access to the target network through phishing attacks or an application vulnerability in intention to initially compromise the network by injecting malicious codes in the infected software or system utility.

Phase 2: Exploitation of the Malware

Once after gaining the initial access to the network, APT groups begin to install there malware they have installed to create backdoors to move inside the network without being detected.

Phase 3: Expanding the access

Even after stage 2, the attack groups try to expand their access undetected in case if the existing entry points or initial vulnerabilities are patched. In this stage, APT groups ensure that the attack continues even if the security measures have been placed. Here, attackers take more of the system controls and get a deeper level of privileges.

Phase 4: Lateral Movement

After threat actors gain access to the network, they can move around the network to find their targets and gain access to multiple systems using companies’ remote tools or legitimate credentials to accomplish lateral movement which is stealthier.

Phase 5: Exfiltration & transfer

At this final stage where malware centralizes the sensitive data, compress & encrypts the data so they can exfiltration to hacker external servers. In this stage target network has been breached and attackers will cover the tracks leaving the networks compromised.

Cybercriminals can repeat the complete process by creating a backdoor for a longer duration of time, until they are detected they can access the breached system later if required.

Characteristics of Advanced Persistent Threats

Advanced Persistent Threat attacks differs from usual threats in multiple ways,

1. APT aims to infiltrate the target networks after the breach.
2. APT often uses phishing attacks to gain a foothold in an enterprise for larger target attacks.
3. Unlike the traditional threat, they remain undetected for a longer duration other than getting detected in Endpoint Protection level & move stealthily inside the network until the data compromise.
4. APT hackers often use an advanced method referred to as Zero-day vulnerabilities using their custom codes.
5. Most of the APT attacks are part of C2s (phishing call-back).
6. Multiple attempts to services can gain a presence of initial access to the network.
7. APT attackers are mostly part of criminal organizations or groups.

Advanced Persistent Threat detections

APT attacks detection components include,

1. Legitimate user accounts are used for unusual activity
2. Recurring Malware & Extensive use of Trojans to create a backdoor which is a common APT technique.
3. The huge number of data bundled into files for data exfiltration process once the successful compromise.
4. Multiple approaches of system services to move laterally without getting detected in any security measures.

Advanced Persistent Threat Prevention and solution

1. Designing and implementing the Security operation centre (SOC) within the enterprise that maintains the strong cybersecurity framework.
2. Investing in the top-notch security tools and team members and provide them the necessary access to tools for analysis.
3. Need to invest in the 3rd party security vendors for internal security penetration testing and internal audits to check for any vulnerabilities or the organization’s weakness towards the external world on the data breaches. And work upon the identified flaws in the enterprise to build a strong security framework.  

Examples of an Advanced Persistent threat Attacks

APT groups are commonly the set of intrusion-related activities usually tracked by the common name in the security community, some of the notable examples of APT groups.

1. Titan Rain – It is a Chinese-based military group that was active in 2003 cyberattacks against US governments that aimed in stealing sensitive state secrets, through an operation the investigators’ named Titan Rain by the US. Hackers group mainly focused on the military data and included APT attacks on high-end systems of NASA and FBI organizations, finally, it was found to the involvement of the Chinese military (People’s Liberation Army).
2. Stuxnet – Worm that infects the Windows Computer through USB sticks. Stuxnet malware is mainly targeted to attack the PLCs (Programmable logic Controllers) which are used to automate machine processes which are mostly used in Industrial Infrastructures. In 2010, it was found to be an active and first known virus capable of crippling hardware, as it was created by the US National Agency, CIA, and Israeli Intelligence. The main focus of this operation to provide the hackers with sensitive information on Iran’s Industrial Infrastructure.
3. Cozy Bear (APT 29) – APT 29 is a threat group that originated from the Russian government and has operated since 2008. APT 29 reportedly compromised the DNC (Democratic National Committee) in the 2015 summer. The adversary of this malware has been identified as large volume spear-phishing campaigns to deliver the malware to target across various Political, scientific, and National security entities. 
4. Lazarus Group (APT 38) – APT 38 is a North Korean Group that is a financially motivated threat group, which mainly targets the banks and financial institutions and has targeted more than 16 organizations in 13 countries since 2014. 
5. Helix Kitten (APT 34) – APT 34 is an Iran-based threat group its active since 2015. It’s called Helix Kitten, which targets organizations in Aerospace, Energy, Financial, Government, Hospitality, and Telecommunications which commonly delivers a custom PowerShell implant through macro-enabled MS office documents through structured spear-phishing mail to highly targeted personals.