[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is an Advanced Persistent Threat (APT)?](/blog/what-is-an-advanced-persistent-threat) Publish date November 19, 2024 {x} minute read # What is an Advanced Persistent Threat (APT)? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) An Advanced Persistent Threat (APT) is a [cyberattack](https://www.upguard.com/blog/cyber-attack) campaign where a threat actor establishes a long-term presence inside a breached network to continuously steal [sensitive data](https://www.upguard.com/blog/sensitive-data). In order to evade detection throughout the entire APT attack life cycle (which could last for many years), these [cyber threats](/blog/cyber-threat) must always exceed the evolving sophistication of common security controls. The advanced attack methods of APT groups makes this cyber threat significantly more difficult to intercept. More difficult but not impossible. By understanding the APT attack sequence, and the subtle indicators of compromise, it is possible to mitigate and even block APT attacks. To learn how, read on. ## Difference Between APT Attacks and Other Cyber Threats There are 5 characteristics that differentiate APT threats from other cyber threats. 1. APT [malware](https://www.upguard.com/blog/malware) is more complicated than other strains of malware, [like Ransomware](https://www.upguard.com/blog/ransomware). 2. APT attacks are usually launched by nation-state cybercriminal groups and not lone hackers. 3. APT attacks are manually executed and not automated (like [Ransomware-as-a-Service attacks](https://www.upguard.com/blog/what-is-ransomware-as-a-service)). 4. The primary objective of APT attacks is not financial gain. 5. APT attacks commonly compromise entire networks and not localized segments. ## Most Common Targets for Advanced Persistent Threats Advanced Persistent Threats are sophisticated because they're well funded and usually coordinated by some of the most advanced hackers in the digital realm - nation-state cybercriminals. To ensure a substantial return on the superior resource and expertise investments required to launch APT attacks, APT groups won't waste time targeting low-value victims. Their cross-hairs are fixed on the entities hosting the most valuable sensitive information or targets that will cause the [greatest detriment to an adversary when compromised](https://www.upguard.com/news/colonial-pipeline-ransomware-attack). These include: * Critical infrastructures * Financial entities * Law firms * Large organizations APT groups are on the hunt for the following types of data: * Sensitive internal information (employee credentials, customer [Personal Identifiable Information](https://www.upguard.com/blog/personally-identifiable-information-pii)) * Intellectual Property (Trading plans, patents, marketing plans, product development). * Privileged credentials The preference of large enterprises doesn't mean smaller organizations aren't at risk of suffering an APT attack. Vendors within the supply chain network of a target are vulnerable to attacks because they're usually easier to compromise and they have access to the private resources of the target organization, making them the perfect [attack vectors](https://www.upguard.com/blog/attack-vector). Such cyber-attacks are known as [Supply Chain Attacks](https://www.upguard.com/blog/supply-chain-attack) and their convenient facilitation of backdoors to prime targets is fueling their increasing popularity. ### The 6 Stages of an Advanced Persistent Threat Attack The trend of APT attacks is expected to keep climbing. By 2025 it is estimated that the Advanced Persistent Threat market will be worth [almost $12.5 billion U.S dollars](https://www.statista.com/statistics/497945/advanced-persistent-threat-market-worldwide/). The silver lining to this provocative trend is that enough [threat intelligence](https://www.upguard.com/blog/threat-intelligence) has been collected to map the sequence of APT attacks. By understanding the evolution of APT attacks, security measures can be strategically implemented at each successive stage to progressively obfuscate the success potential of these attacks. The progression of APT attacks can be described in two dimensions - linearly and cyclically. The linear trajectory illustrates the evolution of an APT attack through its 6 stages. The cyclical trajectory illustrates the APT burrowing strategy of APT attacks, where attackers penetrate deeper into a network as privileged credentials are discovered and compromised. The 6 progression stages of an APT attack are discussed below. ### Stage 1: Reconnaissance The prestigious entities being targeted in APT attacks have sufficient funding for sophisticated cybersecurity controls. Because of this, cyberattacks cannot begin their attack sequence with infiltration. Several reconnaissance campaigns are initially required to detect potential entry points into an organization's network. Solutions commonly used for penetration testing and network analytics tools could clandestinely detect overlooked [vulnerabilities](https://www.upguard.com/blog/vulnerability) that could facilitate an APT attack. Some examples of such solutions are listed below. Each item links to further information. * [Recon- NG](https://www.kali.org/tools/recon-ng/) (also on [GitHub](https://github.com/lanmaster53/recon-ng)) * [Censys](https://gbhackers.com/shoda-censys-internet/) * [Open-Port checking tools](https://www.upguard.com/blog/best-open-port-scanners) * [Datasploit](https://dzone.com/articles/osint-with-datasploit) (also on [GitHub](https://github.com/DataSploit/datasploit)) * [Aquatone](https://www.kitploit.com/2017/07/aquatone-tool-for-domain-flyovers.html) (also on [GitHub](https://github.com/michenriksen/aquatone)) * [Spiderfoot](https://www.spiderfoot.net/index.html) * [Shodan](https://www.shodan.io/) ### Stage 2: Gain Access After potential entry points have been detected, hackers then attempt exploitation to gain network access. This process is usually an orchestrated attack targeting multiple attack vectors within quick succession. The breach tactics that make a regular appearance in an APT attackers toolkit include: * [Spear phishing emails](https://www.upguard.com/blog/spear-phishing) - Seemingly innocuous emails that include infected links to credential-stealing malware. These threats are also known as Spear-Phishing Attacks. * [Zero-Day Exploits](https://www.upguard.com/blog/zero-day) - Software vulnerabilities that have not been addressed with security patches. * [Social Engineering](https://www.upguard.com/blog/social-engineering) - Tricking victims into divulging sensitive credentials either via a telephone call or digitally (online chat, email, etc). ### Stage 3: Establish a Foothold After breaching an IT ecosystem, cybercriminals then deploy trojan malware that establishes a series of backdoor connections to criminal servers (command and control servers) to facilitate the exfiltration of sensitive data. Once these backdoors are established, a persistent presence is achieved. [Learn more about data exfiltration](https://www.upguard.com/blog/how-to-detect-data-exfiltration). ### Stage 4: Escalate Privileges Threat actors then move laterally along the target network looking for privileged credentials that will grant them even deeper access. ### Stage 5: Maintain Presence APT attackers will remain entrenched for an extended period of time monitoring network activity. When they decide to steal data, their malicious activity is hidden behind legitimate processes or obfuscated with code re-writing practices to evade detection by antivirus solutions and security teams. ### Stage 6: Exfiltrate Data When hackers discover valuable information, it's transferred through the backdoors established in stage 3 and into their servers. This usually transpires alongside legitimate network processes to mitigate suspicious network activity spikes. If there's a risk of these transfers being intercepted by security teams, APT hackers could deploy white noise tactics [like DDoS attacks](https://www.upguard.com/blog/what-is-a-ddos-attack) to divert attention away from exfiltration processes. White noise attacks are also deployed to distract security teams before a deeper level of the network is compromised (see figure 4 - cyclical attack lifecycle). ## Top 5 Examples of Advanced Persistent Threats The 5 most popular Advance Persistent Threats include: * The Stuxnet Worm - Still considered the most sophisticated strain of malware ever developed, the Stuxnet worm was used to attack Iran's nuclear program. The malware was injected via an infected USB stick.\ \ [Learn more about the Stuxnet worm](https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/). * APT28 - A Russian APT (also known as Fancy Bear) used to target government entities in Eastern Europe.\ \ [Learn more about APT28](https://attack.mitre.org/groups/G0007/). * APT29 - A Russian APT known as 'Cozy Bear.' This APT is linked to the[ 2015 Pentagon cyberattack](https://thehill.com/policy/cybersecurity/250461-russian-hackers-crack-pentagon-email-system).\ \ [Learn more about APT29](https://attack.mitre.org/groups/G0016/). * APT34 - Is an APT allegedly created by an Iranian cyber [espionage](https://www.upguard.com/blog/corporate-espionage) cybercriminal group. Since 2014, the threat group has been targeting governments and critical infrastructures in the Middle East.\ \ [Learn more about APT34](https://www.boozallen.com/s/insight/blog/dark-labs-discovers-apt34-malware-variants.html). * APT37 - Is an APT associated with a state-sponsored cyber espionage group representing North Korea. APT37 was used to exploit Adobe Flash's zero-day vulnerability [CVE-2018-4878](https://nvd.nist.gov/vuln/detail/cve-2018-4878).\ \ [Learn more about APT37](https://attack.mitre.org/groups/G0067/). ## Evidence of an Advanced Persistent Threat Attack APT groups have established a reputation for evading even the most sophisticated of threat detection solutions. Vigilant incident response teams and defense contractors could detect APT attack attempts by monitoring for the following key indicators: * Suspicious increases in network activity outside of business hours. * Suspicious transfers of large amounts of data either between endpoints or out of an internal network. * Backdoor trojans embedded inside a network ([learn how to detect backdoors](https://core.ac.uk/download/pdf/301546565.pdf)). ## How to Prevent APT Attacks There are 5 security controls that could prevent APT malware injections and their resulting cyberattacks. The following figure illustrates their implementation across the APT attack lifecycle. ### 1. Monitor all Incoming and Outgoing Traffic Implementing network firewalls along the perimeter of a network is one of the best methods of detecting malicious data exfiltration and backdoor installation attempts. Web Application Firewalls (WAF) could prevent application layer attacks against web app servers. This security control could block SQL attacks and [brute force attacks](https://www.upguard.com/blog/brute-force-attack) - common tactics implemented during the infiltration stage of an APT attack. ### 2. Domain Whitelisting Domain whitelisting allows organizations to specify which domains and applications are permitted to access private networks. To maximize efficacy, domain whitelisting should be coupled with continuous [security posture](https://www.upguard.com/blog/security-posture) measurement for all approved domains and enforced software update policies for all permitted applications. ### 3. Multi-Factor Authentication (MFA) [Multi-Factor Authentication](https://www.upguard.com/blog/mfa-multi-factor-authentication) could disrupt the lateral movement phase of an APT attack (stage 5). If all access is gated with multi-factor authentication, APT attacks will have trouble compromising privileged credentials to burrow deeper into sensitive resources. ### 4. Secure Privileged Access Management (PAM) Bolstering the security of [Privileged Access Management](https://www.upguard.com/blog/privileged-access-management) strategies, in addition to multi-factor authentication, will make privileged escalation an exceedingly frustrating endeavor to APT attacks. [Learn how to secure PAM.](https://www.upguard.com/blog/prevent-supply-chain-attacks-by-securing-pam) ### 5. Discover and Remediate all Security Vulnerabilities The ideal APT attack defenses are those that prevent attackers from gaining access to a network. But access points are difficult to detect across an ever-expanding attack surface. An attack surface monitoring solution can detect software vulnerabilities, even along the most convoluted attack surface - cloud technology. The rapid remediation that's possible with such solutions helps organizations bolster their cybersecurity exposures before they're detected by APT hackers - preventing the APT attack cycle from progressing beyond stage 1. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)