What Is an Advanced Persistent Threat (APT)? Stages & Groups

An advanced persistent threat (APT) is a prolonged, stealthy, and targeted intrusion in which a well-resourced attacker gains access to a specific organization and stays inside it to pursue a defined objective.

That objective is espionage, intellectual property theft, financial theft, or pre-positioning for future disruption.

Commodity attacks take whatever they find and move on. APT operators pick the target first, then keep returning until they achieve the goal, rebuilding access after each eviction attempt.

What Makes an APT Advanced and Persistent

Each word in the term carries a specific meaning, and the first one causes most of the confusion.

• Advanced: Operational capability, not exotic malware. Many APT campaigns begin with spear phishing and stolen passwords, and the sophistication shows up in target research, patience, and the ability to adapt when a control blocks them.
• Persistent: Objective-driven instead of opportunistic. Operators maintain access for months, return through second and third footholds, and accept slower progress in exchange for staying hidden.
• Threat: Human operators with intent and resources behind the tooling, which separates an APT from automated malware that runs to a fixed script.

Zero-day exploitation appears in APT campaigns, and treating it as the defining trait misreads the risk. A group that phishes an employee, collects valid credentials, and logs in through a VPN has achieved the same result as one burning a zero-day, at a fraction of the cost.

How Advanced Persistent Threats (APT) Operate

An APT attack moves through three stages: infiltration, expansion, and extraction, each mapping to specific tactics in the MITRE ATT&CK framework.

Reconnaissance runs before all three stages and continues throughout. Operators study org charts, job postings, supplier relationships, and exposed infrastructure to pick a target, choose a lure, and select the technology worth exploiting.

Stage 1: Infiltration

Operators gain the first foothold through spear-phishing attachments, exploited internet-facing appliances, stolen credentials bought from access brokers, or a compromised supplier in the software supply chain.

Initial payloads stay small and quiet enough to survive the first week. A loader establishes persistence through a registry key or scheduled task, checks for analysis tools, and waits before contacting command-and-control infrastructure.

ATT&CK tactics in play here are initial access, execution, and persistence. Dwell begins at this point, and the intrusion generates its smallest detection footprint of the entire campaign.

Stage 2: Expansion

Internal reconnaissance maps domains, network shares, and administrative accounts across the estate. Credential theft from memory and browser stores feeds lateral movement through remote services, and privilege escalation opens the identity infrastructure that controls everything else.

Redundancy defines this stage more than speed does. Operators plant multiple persistence mechanisms across separate hosts, so removing one implant leaves the campaign intact and the defender believing the incident closed.

Discovery, credential access, privilege escalation, and lateral movement all belong to this stage. It produces the noisiest telemetry of the campaign, which makes it the strongest detection window defenders get.

Stage 3: Extraction

Collection happens inside the network first, where data is compressed and staged in archives split into small parts. Exfiltration travels over encrypted channels, cloud storage services, or the same protocols employees use daily.

Cleanup work follows every transfer out of the network. Operators delete staging archives, clear or thin event logs, alter file timestamps, and retire the tooling that served its purpose, leaving the quieter access channels untouched.

Not every APT campaign ends in data theft at all. Pre-positioning operations skip exfiltration entirely and hold quiet access inside IT and OT environments, waiting for a moment when disruption serves a strategic purpose.

Stage boundaries blur in practice, and the sequence rarely runs once. Campaigns cycle back from extraction to expansion as new intelligence requirements arrive, and a partial eviction sends operators to stage one again through a foothold nobody found.

APT Tradecraft in a Real Campaign

CloudSEK's TRIAD team documented an Iran-linked MuddyWater campaign that shows each stage in operational detail. The RustyWater investigation traced spear-phishing against diplomatic, maritime, financial, and telecom organizations across the Middle East.

• Credible sender: Lures arrived from legitimate government and enterprise mailboxes, and CloudSEK found leaked credentials for those addresses, which explains how the impersonation worked.
• Deceptive payload: A Word document with an embedded macro dropped a Rust implant disguised by icon spoofing, while a decoy PDF opened to keep the victim unsuspecting.
• Quiet persistence: The implant wrote itself to a Windows startup registry key and delayed its beaconing, leaving minimal forensic artifacts on disk.
• Active evasion: The malware registered an exception handler to detect debugging, encrypted its strings, and scanned for the agent files and service names of more than 25 antivirus and EDR products.
• Modular expansion: Operators enabled new collection and credential-theft functions through the existing implant instead of delivering fresh binaries.

Tooling evolution carries the analytic lesson here. MuddyWater historically relied on PowerShell and VBS loaders, and the move to Rust produced a quieter, modular implant that existing detections were never written for.

Who Runs APT Campaigns

APT operations divide into three sponsor categories, and state backing is not a requirement for the label.

• State-sponsored groups: Intelligence and military units conducting cyber espionage or pre-positioning, funded to sustain operations for years against the same targets.
• State-aligned contractors: Private companies and freelance operators selling access, exploits, or entire campaigns to government customers, which blurs attribution.
• Financially motivated groups: Crews applying APT-grade patience to theft, including North Korean operations that fund state programs through cryptocurrency heists.

Criminal groups increasingly borrow the same tradecraft for their own ends. Ransomware crews now conduct weeks of reconnaissance before encryption, a pattern visible across ransomware intelligence reporting.

Objective separates the two categories more cleanly than skill does.

How APT Groups Are Organized Internally

APT operations run on staffed teams with defined roles, reporting lines, and budgets, a structure that rarely surfaces in public reporting because the evidence stays inside the group.

CloudSEK's TRIAD team analyzed a leaked repository of internal documents belonging to the IRGC-linked APT35, tracked elsewhere as Charming Kitten. The Persian-language files covered personnel rosters, monthly reports, and campaign records from an active espionage operation.

• Separate functional teams: Penetration testing, malware development, social engineering, and infrastructure ran as distinct specializations rather than one pool of generalists.
• Employment mechanics: Operators carried badge numbers, logged 150 to 200 hours a month on timesheets, took authorized leave, and submitted reports to a management layer that approved spending.
• Role specialization: One operator focused on SQL injection and mass exploitation of network devices, another built remote access tooling against an Active Directory test lab, and another ran phishing infrastructure across advertising platforms, SIM cards, and payment services.
• Rapid exploitation capacity: The team weaponized CVE-2024-1709 in ConnectWise within 24 hours of its disclosure and scanned targets across six countries.
• Long-horizon operations: One documented intrusion combined domain compromise, a pivot through a partner organization, EDR evasion, and more than 74 GB of exfiltrated data from a single victim.

Defensive implications follow directly from that structure. A group with dedicated malware developers rebuilds tooling after detection, a group with a social engineering team keeps producing new lures, and a group with salaried staff continues the campaign whether or not any single intrusion succeeds.

Why One APT Group Has Five Names

Vendors assign their own designations because attribution clusters form independently, so a single group appears under several names at once.

• Numbered designations: Sequential labels such as APT28 and APT36, assigned as researchers confirm a distinct, persistent cluster.
• Weather-themed names: Microsoft's taxonomy ties a weather word to a country of origin, with Typhoon for China, Blizzard for Russia, Sandstorm for Iran, and Sleet for North Korea.
• Animal-themed names: Other vendors pair an animal with a nation, producing names such as Bear, Panda, Kitten, and Chollima.
• Temporary cluster IDs: Unattributed activity receives a neutral identifier, such as a UNC number, until evidence supports naming it.
• Framework group IDs: MITRE ATT&CK assigns each tracked group a G-number and lists the aliases mapped to it.

Alias confusion carries a practical cost inside security teams. Two teams reading reports about the same intrusion set under different names duplicate work, so threat analysis starts by resolving aliases before comparing behavior.

Major APT Groups and Campaigns

Public attribution comes from government advisories and vendor investigations, with confidence levels that vary by case.

Volt Typhoon changed how defenders read the word persistence. CISA, the NSA, and the FBI reported that the group maintained access inside some victim environments for at least five years without deploying conventional malware, using valid accounts and built-in system tools throughout.

Telecom intrusions produced a second shift in official language. A joint advisory issued in August 2025 described Chinese state-sponsored actors compromising networks worldwide to feed espionage collection, and deliberately described the behavior rather than the vendor alias.

Financially motivated operations reached comparable scale in 2025. The FBI attributed the theft of roughly $1.5 billion from Bybit in February 2025 to North Korean actors it tracks as TraderTraitor, the largest cryptocurrency heist recorded.

Regional campaigns deserve the same attention as headline groups. CloudSEK's APT36 investigation documented Pakistan-linked espionage against Indian government and defense entities using Linux desktop-entry files and Google Drive for payload delivery.

Why APT Intrusions Stay Undetected

Detection fails against APT campaigns for structural reasons, not because teams ignore alerts.

• Valid accounts: Logins with stolen credentials generate authentication events that look ordinary, especially from expected locations.
• Living off the land: PowerShell, WMI, scheduled tasks, and remote management tools accomplish the work without introducing files antivirus recognizes.
• Edge device blind spots: Firewalls, VPN gateways, and routers rarely run EDR agents, and their logs rarely carry the detail an investigation needs.
• Patient pacing: Small actions spread across weeks never breach the thresholds that trigger volume-based alerts.
• Redundant access: Removing one implant leaves others in place, so activity resumes after a case is closed.

Dwell time figures reflect that design directly. Mandiant's M-Trends 2026 reported a global median dwell time of 14 days across investigations, while espionage and North Korean IT worker cases ran undetected for a median of 122 days.

How to Detect APT Activity

To detect APT activity, security teams hunt for behavioral patterns across identity, endpoint, network, and data layers instead of waiting for signature alerts.

• Identity signals: Service accounts authenticating interactively, new MFA methods registered on privileged accounts, and access at hours the user never works.
• Endpoint signals: Office applications spawning scripting engines, new registry Run keys and scheduled tasks, and credential access attempts against LSASS.
• Network signals: Regular beaconing intervals to the same destination, DNS queries to newly registered domains, and administrative protocols crossing segments that never talked before.
• Data signals: Archives appearing in temporary directories, staging on file servers, and large transfers to cloud storage outside business processes.
• Infrastructure signals: Configuration changes on edge appliances, unexpected accounts on network devices, and firmware that no longer matches vendor images.

External signals matter as much as the telemetry inside the network. Credential exposure surfaced through leaked credential monitoring and campaign reporting from dark web monitoring indicates targeting before any internal alert fires.

Hunting converts those raw signals into findings worth acting on. Analysts start from a hypothesis drawn from current campaign reporting, search existing telemetry for the matching behavior, and escalate what survives scrutiny to the SOC for containment.

How to Defend Against APT Attacks

APT defense works by removing easy entry points, limiting movement after compromise, and shortening the time between intrusion and discovery.

1. Enforce phishing-resistant MFA on email, VPN, and administrative access, closing the credential path most campaigns start with.
2. Patch internet-facing systems first, prioritizing appliances with known exploited vulnerabilities.
3. Reduce the attack surface by inventorying exposed assets through external attack surface management and retiring what nobody owns.
4. Segment networks and apply least privilege, so one compromised host reaches a limited set of systems under a zero trust model.
5. Tier administrative accounts, keeping domain administrator credentials off workstations and general servers.
6. Centralize and retain logs, including edge device telemetry, for long enough to investigate a months-old intrusion.
7. Hunt proactively against current campaign reporting instead of waiting for automated detection.
8. Map attack paths across identity and exposure, using an attack path view to find the chains an operator follows.
9. Vet third parties continuously, since a supplier compromise produces a third-party breach with the same consequences as a direct one.

CloudSEK's guide to preventing advanced persistent threats covers each control in implementation detail.

Responding to a Confirmed APT Intrusion

Response to an APT differs from standard incident handling because premature eviction warns an operator who still holds other access.

1. Scope before acting, identifying every compromised account, host, and persistence mechanism while monitoring quietly.
2. Preserve evidence from memory, edge devices, and logs before rebuilding anything.
3. Evict in one coordinated action, closing all footholds and rotating credentials, keys, and certificates together.
4. Rebuild identity trust, including domain key material that survives password resets.
5. Report to authorities such as CISA, the FBI, or CERT-In, and meet regulatory notification duties with legal counsel.
6. Hunt again after eviction, since APT operators routinely attempt to return through a path nobody documented.

Tracking APT Campaigns With CloudSEK Threat Intelligence

Detecting an APT inside the network belongs to EDR, identity monitoring, and dedicated hunting teams.

Knowing which groups target the organization’s sector, what tools they recently adopted, and which credentials are already circulating outside the perimeter is equally important.

CloudSEK Threat Intelligence provides this context by tracking threat actors and their TTPs, exploited CVEs, malware families, and campaign activity, curated to a customer's industry and region.

The investigations into MuddyWater, APT35, and APT36 highlight the same research team’s depth and reach in campaign‑level tracking. 

Advanced Persistent Threat (APT) FAQs

How long does an APT attack last?

Campaigns run from weeks to years. Espionage operations persist for months, and some critical infrastructure intrusions have lasted five years or more.

What is the difference between an APT and ransomware?

Ransomware seeks fast payment and announces itself. An APT stays hidden to collect intelligence or hold access, though some groups now use both approaches.

Can a small business be an APT target?

Yes. Small suppliers, law firms, and contractors get targeted for the access and data they hold on behalf of larger organizations.

Do APT groups always use zero-day exploits?

No. Most campaigns start with phishing, stolen credentials, or unpatched known vulnerabilities, and zero-days appear only where cheaper routes fail.

What is mercenary spyware?

Mercenary spyware is commercial surveillance software sold to government customers, deployed against journalists, dissidents, and officials through APT-style operations.

How do organizations learn they were named in an APT report?

Notification arrives through government agencies, industry sharing groups, hosting providers, or vendor outreach, ahead of internal detection in many cases.