What is advanced persistent threat detection?

When it comes to cyberattacks, most people imagine an incident that’s short and intense. Think of script kiddies bringing down your website with a DDoS attack, or data breaches that gain access to your network to steal data.

However, the most insidious — and potentially most damaging — cyberattacks take a different form: the advanced persistent threat.

But what is advanced persistent threat detection and how can you defend your organization against APTs? In this article, we’ll discuss the definition of advanced persistent threat detection plus provide best practices for detecting and mitigating advanced persistent threats.

What is advanced persistent threat detection?

In cyber security, advanced persistent threats (APTs) are malicious actors that use sophisticated methods to stealthily infiltrate an information system and remain hidden for an extended period. APTs may spend this time gathering intelligence, installing ransomware or other malware, and stealing intellectual property or other sensitive data. Many APTs are sponsored by large criminal or terrorist organizations, and some are even state-sponsored (e.g. by North Korea or Iran).

Advanced persistent threat detection, then, is the task of identifying an APT threat actor that has already entered an IT system. Given that the goal of an APT attack is to remain undetected as long as possible, advanced persistent threat detection often requires knowledge and techniques that are just as sophisticated as the attacks themselves.

What are examples of an advanced persistent threat?

Advanced persistent threat actors often use social engineering tactics to trick users into revealing their security credentials. For example, “spear phishing” attacks target a specific individual by impersonating a trusted third party. Other APT attacks exploit a vulnerability in a network or software application — sometimes even before this flaw has been reported to the public.

Some of the most well-known examples of APT attacks and actors are:

• Stuxnet: One of the most famous (and impactful) APTs, the Stuxnet computer worm infects supervisory control and data acquisition (SCADA) systems. The worm was discovered in 2010 and is believed to have been jointly designed by the United States and Israel to target Iran’s nuclear centrifuges.
• APT33 et al.: Iran is believed to have several of its own APT groups, including APT33, APT34, APT35, and APT39. These threat actors have been active for several years, with different targets in the U.S., western Europe, and the Middle East. The groups have attacked institutions across a wide range of industries, including government, military, defense, energy, telecommunications, and the media.
• Lazarus Group: The North Korea-linked Lazarus Group has been responsible for several notable cyber incidents over the past decade. The group was connected to the hack of Sony Pictures in November 2014 in retaliation for the upcoming release of the comedy film The Interview, which depicted a plot to assassinate Kim Jong-un. Lazarus Group was also in the headlines in 2016, when it nearly pulled off a scheme to steal $1 billion from the central bank of Bangladesh.

How to detect advanced persistent threats

Because advanced persistent threats are difficult to perceive by design, APT detection will require more sophisticated techniques than standard cyber security tools.

Want to enact a rigorous advanced persistent threat defense program within your organization? Below are some basic tips for how to detect advanced persistent threat actors:

• Identify strange email activity: As discussed above, “spear phishing” emails are some of APT groups’ favorite tools. These malicious email campaigns often require in-depth research about a target’s behavior, social network, or personal life. Be wary of emails with unexpected file attachments and those that ask you to visit a website and input your login credentials. Train employees on how to recognize suspicious emails and what to do if they receive one — at a minimum, they can report it to the IT department.
• Look for suspicious user activity: Once they have a user’s credentials, APT actors will attempt to impersonate that user while accessing your IT environment. Tools such as MDR or XDR systems can help track activity on the various endpoint computers in your network. Search for unusual behavioral patterns such as users frequently logging in at night in their time zone, or accessing files they don’t need for their work.
• Follow the data: Data movement patterns are one indication that an APT attack is underway. Look for unusual traffic patterns, such as data flowing between two endpoints or devices. Another suspicious sign is data compressed in large archives, which could indicate that attackers have condensed these files for easier exfiltration.

When is your business ready for advanced persistent threat tools?

Fortunately, not every organization has to worry about advanced persistent threats. However, at-risk businesses must enact appropriate security measures, such as advanced persistent threat detection tools.

The largest targets should think proactively, moving from advanced persistent threat detection to advanced persistent threat protection. This involves the use of threat intelligence to understand APT groups’ motivations, behavioral patterns, technical “fingerprints,” and more. These organizations should also invest in XDR or SIEM software that can collect and analyze log and network data.

Below are two indications that you should invest in advanced persistent threat detection software:

• You’re a large enough target: Startups and small businesses generally don’t face risk from APT groups because they don’t possess enough valuable information. As your business grows, however, so will the amount of sensitive data and intellectual property you possess, which makes you a more attractive target. Larger organizations also have larger IT environments, giving a wide attack surface with many potential entry points.
• You operate in a sensitive industry: Because they're associated with a nation-state or other major entity, APT groups often have broader geopolitical aims. Companies in sensitive industries such as government, defense, media, telecommunications, software and technology, energy, and finance are appealing targets of APT attacks.

How to get started with advanced persistent threat detection

The good news is that there’s no shortage of APT defense technologies on the market. However, technology is of limited use without the expertise and experience to know how to use it. That’s why, for the strongest IT security posture, you should partner with the right IT managed services provider.

If you believe your organization could be the target of advanced persistent threats, there’s little time to waste. Speak with a knowledgeable, qualified IT managed detection and response provider who can talk through your options and help you set up a robust cyber defense program.

Looking for the right IT security partner? UncommonX is an IT managed services provider that offers a unified suite of security solutions: the BOSS XDR platform. With the BOSS platform, organizations have a powerful suite of cyber security defenses at their fingertips—everything from threat protection to incident response.

Contact our team of cyber security experts today to discuss your situation, get a security assessment, or see a demo of the BOSS platform.