Advance Persistent Threat

Advance Persistent Threat

1. What is an APT?

   • Type of targeted attack
     • Customized attack
     • Low and slow
     • Hackers have high aspirations
     • Specific target

2. Phase 1: Incursion

   • Hackers break into the organization's network
     • Social engineering
     • Zero-day vulnerabilities
     • Manual operations
   • Reconnaissance
     • The attackers spend months studying the target

3. Phase 2: Discovery

   • Once inside, the attacker maps out the organization's systems
   • Avoid detection
   • Run silent, run deep
     • Remain inside the organization and harvest information long-term

4. Phase 3: Capture

   • Exposed data stored on unprotected systems is accedded.
   • Rootkits may be installed on targeted systems
   • Long-term occupancy
     • Designed to capture information over an extended period.
   • Remote ignition of automated software and hardware systems

5. Phase 4: Exfiltration

   • Theft of intellectual property or confidential data
   • Attackers encrypt and transmit the stolen data