Advanced persistent threat

This is an old revision of this page, as edited by Horse Eye Jack (talk | contribs) at 16:51, 22 May 2020 (→China). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Revision as of 16:51, 22 May 2020 by Horse Eye Jack (talk | contribs) (→China)(diff) ← Previous revision | Latest revision (diff) | Newer revision → (diff) Set of stealthy and continuous computer hacking processes

v t e Information security
Related security categories	Computer security Automotive security Cybercrime Cybersex trafficking Computer fraud Cybergeddon Cyberterrorism Cyberwarfare Electromagnetic warfare Information warfare Internet security Mobile security Network security Copy protection Digital rights management	vectorial version
Threats	Adware Advanced persistent threat Arbitrary code execution Backdoors Bombs Fork Logic Time Zip Hardware backdoors Code injection Crimeware Cross-site scripting Cross-site leaks DOM clobbering History sniffing Cryptojacking Botnets Data breach Drive-by download Browser Helper Objects Viruses Data scraping Denial-of-service attack Eavesdropping Email fraud Email spoofing Exploits Fraudulent dialers Hacktivism Infostealer Insecure direct object reference Keystroke loggers Malware Payload Phishing Voice Polymorphic engine Privilege escalation Ransomware Rootkits Scareware Shellcode Spamming Social engineering Spyware Software bugs Trojan horses Hardware Trojans Remote access trojans Vulnerability Web shells Wiper Worms SQL injection Rogue security software Zombie
Defenses	Application security Secure coding Secure by default Secure by design Misuse case Computer access control Authentication Multi-factor authentication Authorization Computer security software Antivirus software Security-focused operating system Data-centric security Obfuscation (software) Data masking Encryption Firewall Intrusion detection system Host-based intrusion detection system (HIDS) Anomaly detection Information security management Information risk management Security information and event management (SIEM) Runtime application self-protection Site isolation

An advanced persistent threat (APT) is a stealthy computer network threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state sponsored groups conducting large-scale targeted intrusions for specific goals.

Such threat actors' motivations are typically political or economic. Every major business sector has recorded instances of attacks by advanced actors with specific goals seeking to steal, spy or disrupt. These sectors include government, defense, financial services, legal services, industrial, telecoms, consumer goods and many more. Some groups utilize traditional espionage vectors, including social engineering, human intelligence and infiltration to gain access to a physical location to enable network attacks. The purpose of these attacks is to place custom malicious code on one or multiple computers for specific tasks.

The median "dwell-time", the time an APT attack goes undetected, differs widely between regions. FireEye reports the mean dwell-time for 2018 in the Americas is 71 days, EMEA is 177 days and APAC is 204 days. This allows attackers a significant amount of time to go through the attack cycle, propagate and achieve their objective.

Definition

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:

Advanced – Operators behind the threat have a full spectrum of intelligence-gathering techniques at their disposal. These may include commercial and open source computer intrusion technologies and techniques, but may also extend to include the intelligence apparatus of a state. While individual components of the attack may not be considered particularly "advanced" (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools, and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from "less advanced" threats.
Persistent – Operators have specific objectives, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.
Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code. The operators have a specific objective and are skilled, motivated, organized and well funded. Actors are not limited to state sponsored groups.

Criteria

One of the first theories for defining criteria as a threat on the opportunistic - APT continuum as either persistent or non-persistent was first proposed in 2010. These APT criteria are now widely used in the industry and are built off of an evaluation of these following details:

Objectives – The end goal of your threat, your adversary.
Timeliness – The time spent probing and accessing your systems.
Resources – The level of knowledge and tools used in the event.
Risk tolerance (by the adversary) – The extent the threat will go to remain undetected.
Skills and methods – The tools and techniques used throughout the event.
Actions – The precise actions of a threat or numerous threats.
Attack origination points – The number of points where the event originated.
Numbers involved in the attack – How many internal and external systems were involved in the event, and how many peoples systems have different influence/importance weights.
Knowledge source – The ability to discern any information regarding any of the specific threats through online information gathering.

History and targets

Warnings against targeted, socially-engineered emails dropping trojans to exfiltrate sensitive information were published by UK and US CERT organisations in 2005. This method was used throughout the early 1990s and does not in itself constitute an APT. The term "advanced persistent threat" has been cited as originating from the United States Air Force in 2006 with Colonel Greg Rattray cited as the individual who coined the term. However, the term APT was used within telecommunications carriers years previously.

The Stuxnet computer worm, which targeted the computer hardware of Iran's nuclear program, is one example. In this case, the Iranian government might consider the Stuxnet creators to be an advanced persistent threat.

Within the computer security community, and increasingly within the media, the term is almost always used in reference to a long-term pattern of sophisticated computer network exploitation aimed at governments, companies, and political activists, and by extension, also to ascribe the A, P and T attributes to the groups behind these attacks. Advanced persistent threat (APT) as a term may be shifting focus to computer-based hacking due to the rising number of occurrences. PC World reported an 81 percent increase from 2010 to 2011 of particularly advanced targeted computer attacks.

Actors in many countries have used cyberspace as a means to gather intelligence on individuals and groups of individuals of interest. The United States Cyber Command is tasked with coordinating the US military's offensive and defensive cyber operations.

Numerous sources have alleged that some APT groups are affiliated with, or are agents of, governments of sovereign states. Businesses holding a large quantity of personally identifiable information are at high risk of being targeted by advanced persistent threats, including:

Higher education
Financial institutions
Energy
Transportation
Technology
Health care
Telecommunications
Manufacturing
Agriculture

A Bell Canada study provided deep research into the anatomy of APTs and uncovered widespread presence in Canadian government and critical infrastructure. Attribution was established to Chinese and Russian actors.

Life cycle

Actors behind advanced persistent threats create a growing and changing risk to organizations' financial assets, intellectual property, and reputation by following a continuous process or kill chain:

Target specific organizations for a singular objective
Attempt to gain a foothold in the environment (common tactics include spear phishing emails)
Use the compromised systems as access into the target network
Deploy additional tools that help fulfill the attack objective
Cover tracks to maintain access for future initiatives

The global landscape of APT's from all sources is sometimes referred to in the singular as "the" APT, as are references to the actor behind a specific incident or series of incidents, but the definition of APT includes both actor and method.

In 2013, Mandiant presented results of their research on alleged Chinese attacks using APT method between 2004 and 2013 that followed similar lifecycle:

Initial compromise – performed by use of social engineering and spear phishing, over email, using zero-day viruses. Another popular infection method was planting malware on a website that the victim's employees will be likely to visit.
Establish foothold – plant remote administration software in victim's network, create net backdoors and tunnels allowing stealth access to its infrastructure.
Escalate privileges – use exploits and password cracking to acquire administrator privileges over victim's computer and possibly expand it to Windows domain administrator accounts.
Internal reconnaissance – collect information on surrounding infrastructure, trust relationships, Windows domain structure.
Move laterally – expand control to other workstations, servers and infrastructure elements and perform data harvesting on them.
Maintain presence – ensure continued control over access channels and credentials acquired in previous steps.
Complete mission – exfiltrate stolen data from victim's network.

In incidents analysed by Mandiant, the average period over which the attackers controlled the victim's network was one year, with longest – almost five years. The infiltrations were allegedly performed by Shanghai-based Unit 61398 of People's Liberation Army. Chinese officials have denied any involvement in these attacks.

Previous reports from Secdev had previously discovered and implicated Chinese actors.

Mitigation strategies

There are tens of millions of malware variations, which makes it extremely challenging to protect organizations from APT. While APT activities are stealthy and hard to detect, the command and control network traffic associated with APT can be detected at the network layer level with sophisticated methods. Deep log analyses and log correlation from various sources is of limited usefulness in detecting APT activities. It is challenging to separate noises from legitimate traffic. Traditional security technology and methods have been ineffective in detecting or mitigating APTs. Active cyber defense has yielded greater efficacy in detecting and prosecuting APTs (find, fix, finish) when applying cyber threat intelligence to hunt and adversary pursuit activities.

APT groups

China

Further information: Chinese espionage in the United States

PLA Unit 61398 (also known as APT1)
PLA Unit 61486 (also known as APT2)
Buckeye (also known as APT3)
Red Apollo (also known as APT10)
Codoso Team (also known as APT19)
Wocao (also known as APT20)
PLA Unit 78020 (also known as APT30 and Naikon)
Periscope Group (also known as APT40)
Double Dragon (also known as APT41)
Tropic Trooper
Winnti Group

Iran

Elfin Team (also known as APT33)
Helix Kitten (also known as APT34)
Charming Kitten (also known as APT35)
APT39

North Korea

Ricochet Chollima (also known as APT37)
Lazarus Group (also known as APT38)

Russia

Fancy Bear (also known as APT28)
Cozy Bear (also known as APT29)
Voodoo Bear
Venomous Bear

United States

Equation Group

Uzbekistan

SandCat (associated with the National Security Service (Uzbekistan))

Vietnam

OceanLotus (also known as APT32)

References

"What Is an Advanced Persistent Threat (APT)?". www.kaspersky.com. Retrieved 2019-08-11.
"What Is an Advanced Persistent Threat (APT)?". Cisco. Retrieved 2019-08-11.
^ Maloney, Sarah. "What is an Advanced Persistent Threat (APT)?". Retrieved 2018-11-09.
^ "M-Trends Cyber Security Trends". FireEye. Retrieved 2019-08-11.
"Cyber Threats to the Financial Services and Insurance Industries" (PDF). FireEye. Archived from the original (PDF) on 11 August 2019.
"Cyber Threats to the Retail and Consumer Goods Industry" (PDF). FireEye. Archived from the original (PDF) on 11 August 2019.
"Advanced Persistent Threats: A Symantec Perspective" (PDF). Symantec. Archived from the original (PDF) on 8 May 2018.
^ "Advanced Persistent Threats (APTs)". IT Governance.
"Advanced persistent Threat Awareness" (PDF). TrendMicro Inc.
"Explained: Advanced Persistent Threat (APT)". Malwarebytes Labs. 2016-07-26. Retrieved 2019-08-11.
"Reverse Deception".
"Ben Rothke Slashdot". Retrieved 8 May 2019.
"Assessing Outbound Traffic to Uncover Advanced Persistent Threat" (PDF). SANS Technology Institute. Retrieved 2013-04-14.
"Introducing Forrester's Cyber Threat Intelligence Research". Forrester Research. Archived from the original on 2014-04-15. Retrieved 2014-04-14.
"Advanced Persistent Threats: Learn the ABCs of APTs - Part A". SecureWorks. SecureWorks. Retrieved 23 January 2017.
Olavsrud, Thor. "Targeted Attacks Increased, Became More Diverse in 2011". PCWorld.
"An Evolving Crisis". BusinessWeek. April 10, 2008. Archived from the original on 10 January 2010. Retrieved 2010-01-20.
"The New E-spionage Threat". BusinessWeek. April 10, 2008. Archived from the original on 18 April 2011. Retrieved 2011-03-19.
"Google Under Attack: The High Cost of Doing Business in China". Der Spiegel. 2010-01-19. Archived from the original on 21 January 2010. Retrieved 2010-01-20.
"Under Cyberthreat: Defense Contractors". BusinessWeek. July 6, 2009. Archived from the original on 11 January 2010. Retrieved 2010-01-20.
"Understanding the Advanced Persistent Threat". Tom Parker. February 4, 2010. Retrieved 2010-02-04.
"Advanced Persistent Threat (or Informationized Force Operations)" (PDF). Usenix, Michael K. Daly. November 4, 2009. Retrieved 2009-11-04.
"Anatomy of an Advanced Persistent Threat (APT)". Dell SecureWorks. Retrieved 2012-05-21.
Ingerman, Bret. "Top-Ten IT Issues, 2011". Educause Review.
Joaquin Jay Gonzalez III，RogerL.Kemp (2019-01-16). Cybersecurity: Current Writings on Threats and Protection. McFarland, 2019. p. 69. ISBN 9781476674407.
"APT0 Study on the Analysis of Darknet Space for Predictive Indicators of Cyber Threat Activity" (PDF).
"Outmaneuvering Advanced and Evasive Malware Threats". Secureworks. Secureworks Insights. Retrieved 24 February 2016.
EMAGCOMSECURITY (9 April 2015). "APT (Advanced Persistent Threat) Group". Retrieved 15 January 2019.
^ "APT1: Exposing One of China's Cyber Espionage Units". Mandiant. 2013.
"China says U.S. hacking accusations lack technical proof". Reuters. 2013.
"GhostNet" was a large-scale cyber spying operation" (PDF).
RicMessier (2013-10-30). GSEC GIAC Security Essentials Certification All. McGraw Hill Professional, 2013. p. xxv. ISBN 9780071820912.
"Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak". Symantec. 2019-05-07. Archived from the original on 2019-05-07. Retrieved 2019-07-23.
2019-12-19. "Wocao APT20" (PDF). {{cite web}}: |last= has numeric name (help)
Vijayan, Jai. "China-Based Cyber Espionage Group Targeting Orgs in 10 Countries". www.darkreading.com. Dark Reading. Retrieved 12 January 2020.
2019-10-16. "Double Dragon APT41, a dual espionage and cyber crime operation". {{cite web}}: |last= has numeric name (help)
Chen, Joey. "Tropic Trooper's Back: USBferry Attack Targets Air-gapped Environments". blog.trendmicro.com. Trend Micro. Retrieved 16 May 2020.
Cimpanu, Catalin. "Hackers target the air-gapped networks of the Taiwanese and Philippine military". www.zdnet.com. ZDnet. Retrieved 16 May 2020.
Writer, Staff. "Bureau names ransomware culprits". www.taipeitimes.com. Taipei Times. Retrieved 22 May 2020.
Tartare, Mathieu; Smolár, Martin. "No "Game over" for the Winnti Group". www.welivesecurity.com. We Live Security. Retrieved 22 May 2020.
"Equation: The Death Star of Malware Galaxy". Kaspersky Lab. 2015-02-16. Archived from the original on 2019-07-11. Retrieved 2019-07-23.
Gallagher, Sean. "Kaspersky finds Uzbekistan hacking op… because group used Kaspersky AV". arstechnica.com. Ars Technica. Retrieved 5 October 2019.
Panda, Ankit. "Offensive Cyber Capabilities and Public Health Intelligence: Vietnam, APT32, and COVID-19". thediplomat.com. The Diplomat. Retrieved 29 April 2020.

Misplaced Pages