Advanced persistent threat

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:

• Advanced – Operators behind the threat have a full spectrum of intelligence-gathering techniques at their disposal. These may include commercial and open source computer intrusion technologies and techniques, but may also extend to include the intelligence apparatus of a state. While individual components of the attack may not be considered particularly "advanced" (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools, and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from "less advanced" threats.{{Cite web|url=https://www.itgovernance.co.uk/advanced-persistent-threats-apt|title=Advanced Persistent Threats (APTs)|website=IT Governance|access-date=11 August 2019|archive-date=11 August 2019|archive-url=https://web.archive.org/web/20190811090856/https://www.itgovernance.co.uk/advanced-persistent-threats-apt|url-status=live}}{{Cite web|url=https://www.trendmicro.co.uk/media/misc/apt-survey-report-en.pdf|title=Advanced persistent Threat Awareness|website=TrendMicro Inc|access-date=11 August 2019|archive-date=10 June 2016|archive-url=https://web.archive.org/web/20160610083125/http://www.trendmicro.co.uk/media/misc/apt-survey-report-en.pdf|url-status=live}}
• Persistent – Operators have specific objectives, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.{{Cite web|url=https://blog.malwarebytes.com/101/2016/07/explained-advanced-persistent-threat-apt/|title=Explained: Advanced Persistent Threat (APT)|date=2016-07-26|website=Malwarebytes Labs|language=en-US|access-date=2019-08-11|archive-date=9 May 2019|archive-url=https://web.archive.org/web/20190509114627/https://blog.malwarebytes.com/101/2016/07/explained-advanced-persistent-threat-apt/|url-status=live}}
• Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code. The operators have a specific objective and are skilled, motivated, organized and well funded. Actors are not limited to state sponsored groups.

Warnings against targeted, socially-engineered emails dropping trojans to exfiltrate sensitive information were published by UK and US CERT organisations in 2005. This method was used throughout the early 1990s and does not in itself constitute an APT. The term "advanced persistent threat" has been cited as originating from the United States Air Force in 2006{{cite web|title=Assessing Outbound Traffic to Uncover Advanced Persistent Threat|url=https://www.sans.edu/student-files/projects/JWP-Binde-McRee-OConnor.pdf |archive-url=https://web.archive.org/web/20130626233122/https://www.sans.edu/student-files/projects/JWP-Binde-McRee-OConnor.pdf |archive-date=2013-06-26 |publisher=SANS Technology Institute|access-date=2013-04-14}} with Colonel Greg Rattray cited as the individual who coined the term.{{cite web|title=Introducing Forrester's Cyber Threat Intelligence Research|url=http://blogs.forrester.com/rick_holland/13-02-14-introducing_forresters_cyber_threat_intelligence_research|publisher=Forrester Research|access-date=2014-04-14|archive-url=https://web.archive.org/web/20140415054512/http://blogs.forrester.com/rick_holland/13-02-14-introducing_forresters_cyber_threat_intelligence_research|archive-date=2014-04-15}}

The Stuxnet computer worm, which targeted the computer hardware of Iran's nuclear program, is one example of an APT attack. In this case, the Iranian government might consider the Stuxnet creators to be an advanced persistent threat.{{citation needed|date=October 2019}}{{Cite journal|last=Beim|first=Jared|date=2018|title=Enforcing a Prohibition on International Espionage|url=https://www.proquest.com/docview/2012381493|journal=Chicago Journal of International Law|volume=18|pages=647–672|id={{ProQuest|2012381493}}|url-access=subscription|access-date=18 January 2023|archive-date=22 May 2021|archive-url=https://web.archive.org/web/20210522173236/https://www.proquest.com/docview/2012381493|url-status=live}}

Within the computer security community, and increasingly within the media, the term is almost always used in reference to a long-term pattern of sophisticated computer network exploitation aimed at governments, companies, and political activists, and by extension, also to ascribe the A, P and T attributes to the groups behind these attacks.{{cite web|title=Advanced Persistent Threats: Learn the ABCs of APTs - Part A|url=https://www.secureworks.com/blog/advanced-persistent-threats-apt-a|website=SecureWorks|access-date=23 January 2017|archive-date=7 April 2019|archive-url=https://web.archive.org/web/20190407232258/https://www.secureworks.com/blog/advanced-persistent-threats-apt-a|url-status=live}} Advanced persistent threat (APT) as a term may be shifting focus to computer-based hacking due to the rising number of occurrences. PC World reported an 81 percent increase from 2010 to 2011 of particularly advanced targeted computer attacks.{{cite web |last=Olavsrud |first=Thor |title=Targeted Attacks Increased, Became More Diverse in 2011 |date=April 30, 2012 |url=https://www.cio.com/article/2396583/targeted-attacks-increased--became-more-diverse-in-2011.html |work=CIO Magazine |access-date=14 April 2021 |archive-date=14 April 2021 |archive-url=https://web.archive.org/web/20210414115711/https://www.cio.com/article/2396583/targeted-attacks-increased--became-more-diverse-in-2011.html |url-status=dead }}

Actors in many countries have used cyberspace as a means to gather intelligence on individuals and groups of individuals of interest.{{cite web|title=An Evolving Crisis|url=http://www.businessweek.com/magazine/content/08_16/b4080032220668.htm|publisher=BusinessWeek|date=April 10, 2008|access-date=2010-01-20| archive-url= https://web.archive.org/web/20100110120647/http://www.businessweek.com/magazine/content/08_16/b4080032220668.htm| archive-date= 10 January 2010 }}{{cite web|title=The New E-spionage Threat |url=http://www.businessweek.com/magazine/content/08_16/b4080032218430.htm |publisher=BusinessWeek |date=April 10, 2008 |access-date=2011-03-19 |archive-url=https://web.archive.org/web/20110418080952/http://www.businessweek.com/magazine/content/08_16/b4080032218430.htm |archive-date=18 April 2011 }}{{cite web|title=Google Under Attack: The High Cost of Doing Business in China |url=https://www.spiegel.de/international/world/google-under-attack-the-high-cost-of-doing-business-in-china-a-672742.html |first1=Marcel |last1=Rosenbach |first2=Thomas |last2=Schulz |first3=Wieland |last3=Wagner |work=Der Spiegel |date=2010-01-19 |access-date=2010-01-20 |archive-url=https://web.archive.org/web/20100121005238/http://www.spiegel.de/international/world/0%2C1518%2C672742%2C00.html |archive-date=21 January 2010 |url-status=live }} The United States Cyber Command is tasked with coordinating the US military's offensive and defensive cyber operations.{{Cite web|title=Commander Discusses a Decade of DOD Cyber Power|url=https://www.defense.gov/News/News-Stories/Article/Article/2193130/commander-discusses-a-decade-of-dod-cyber-power/|access-date=2020-08-28|website=U.S. DEPARTMENT OF DEFENSE|language=en-US|archive-date=19 September 2020|archive-url=https://web.archive.org/web/20200919001557/https://www.defense.gov/Explore/News/Article/Article/2193130/commander-discusses-a-decade-of-dod-cyber-power/|url-status=live}}

Numerous sources have alleged that some APT groups are affiliated with, or are agents of, governments of sovereign states.{{cite news|title=Under Cyberthreat: Defense Contractors |newspaper=Bloomberg.com |url=https://www.bloomberg.com/news/articles/2009-07-06/under-cyberthreat-defense-contractorsbusinessweek-business-news-stock-market-and-financial-advice |publisher=BusinessWeek |date=July 6, 2009 |access-date=2010-01-20 |archive-url=https://web.archive.org/web/20100111174243/http://www.businessweek.com/technology/content/jul2009/tc2009076_873512.htm |archive-date=11 January 2010 |url-status=live }}{{cite web|title=Understanding the Advanced Persistent Threat|url=http://tominfosec.blogspot.com/2010/02/understanding-apt.html|publisher=Tom Parker|date=February 4, 2010|access-date=2010-02-04|archive-date=18 February 2010|archive-url=https://web.archive.org/web/20100218143530/http://tominfosec.blogspot.com/2010/02/understanding-apt.html|url-status=live}}{{cite web|title=Advanced Persistent Threat (or Informationized Force Operations)|url=https://www.usenix.org/legacy/event/lisa09/tech/slides/daly.pdf|publisher=Usenix, Michael K. Daly|date=November 4, 2009|access-date=2009-11-04|archive-date=11 May 2021|archive-url=https://web.archive.org/web/20210511075023/https://www.usenix.org/legacy/event/lisa09/tech/slides/daly.pdf|url-status=live}}

Businesses holding a large quantity of personally identifiable information are at high risk of being targeted by advanced persistent threats, including:{{cite web|url=https://www.secureworks.com/resources/sb-advanced-threat-protection-with-dell-secureworks|title=Anatomy of an Advanced Persistent Threat (APT)|publisher=Dell SecureWorks|access-date=2012-05-21|archive-date=5 March 2016|archive-url=https://web.archive.org/web/20160305025719/https://www.secureworks.com/resources/sb-advanced-threat-protection-with-dell-secureworks}}

• Agriculture{{cite book |title=Cybersecurity: Current Writings on Threats and Protection |url=https://books.google.com/books?id=FyuFDwAAQBAJ&pg=PA69 |publisher=McFarland |first1=Joaquin Jay III |last1=Gonzalez |first2=Roger L. |last2=Kemp |isbn=978-1-4766-7440-7 |page=69 |date=2019-01-16 }}
• Energy
• Financial institutions
• Health care
• Higher education{{cite web |last1=Ingerman |first1=Bret |first2=Catherine |last2=Yang |title=Top-Ten IT Issues, 2011 |url=https://er.educause.edu/articles/2011/5/topten-it-issues-2011 |date=May 31, 2011 |publisher=Educause Review |access-date=14 April 2021 |archive-date=14 April 2021 |archive-url=https://web.archive.org/web/20210414115711/https://er.educause.edu/articles/2011/5/topten-it-issues-2011 |url-status=live }}
• Manufacturing
• Technology
• Telecommunications
• Transportation

A Bell Canada study provided deep research into the anatomy of APTs and uncovered widespread presence in Canadian government and critical infrastructure. Attribution was established to Chinese and Russian actors.{{Cite web|url=http://publications.gc.ca/collections/collection_2016/rddc-drdc/D68-3-007-2013-eng.pdf |first1=Dave |last1=McMahon |first2=Rafal |last2=Rohozinski |title=The Dark Space Project: Defence R&D Canada – Centre for Security Science Contractor Report DRDC CSS CR 2013-007 |website=publications.gc.ca |access-date=2021-04-01 |archive-date=2016-11-05 |archive-url=https://web.archive.org/web/20161105035412/http://publications.gc.ca/collections/collection_2016/rddc-drdc/D68-3-007-2013-eng.pdf |url-status=live }}

File:Advanced persistent threat lifecycle.jpg

Actors behind advanced persistent threats create a growing and changing risk to organizations' financial assets, intellectual property, and reputation{{cite web|title=Outmaneuvering Advanced and Evasive Malware Threats|url=https://www.secureworks.com/resources/wp-outmaneuvering-advanced-and-evasive-malware-threats|website=Secureworks|publisher=Secureworks Insights|access-date=24 February 2016|archive-date=7 April 2019|archive-url=https://web.archive.org/web/20190407232258/https://www.secureworks.com/resources/wp-outmaneuvering-advanced-and-evasive-malware-threats}} by following a continuous process or kill chain:

1. Target specific organizations for a singular objective
2. Attempt to gain a foothold in the environment (common tactics include spear phishing emails)
3. Use the compromised systems as access into the target network
4. Deploy additional tools that help fulfill the attack objective
5. Cover tracks to maintain access for future initiatives

In 2013, Mandiant presented results of their research on alleged Chinese attacks using APT method between 2004 and 2013{{cite web |url=http://intelreport.mandiant.com/ |title=APT1: Exposing One of China's Cyber Espionage Units |year=2013 |publisher=Mandiant |access-date=19 February 2013 |archive-date=2 February 2015 |archive-url=https://web.archive.org/web/20150202015751/http://intelreport.mandiant.com/ }} that followed similar lifecycle:

• Initial compromise{{snd}}performed by use of social engineering and spear phishing, over email, using zero-day viruses. Another popular infection method was planting malware on a website that the victim's employees will be likely to visit.{{Cite web |date=2021-06-08 |title=What are MITRE ATT&CK initial access techniques |url=https://blog.gitguardian.com/inital-access-techniques/ |access-date=2023-10-13 |website=GitGuardian - Automated Secrets Detection |language=en |archive-date=29 November 2023 |archive-url=https://web.archive.org/web/20231129204105/https://blog.gitguardian.com/inital-access-techniques/ |url-status=live }}
• Establish foothold{{snd}}plant remote administration software in victim's network, create net backdoors and tunnels allowing stealth access to its infrastructure.
• Escalate privileges{{snd}}use exploits and password cracking to acquire administrator privileges over victim's computer and possibly expand it to Windows domain administrator accounts.
• Internal reconnaissance{{snd}}collect information on surrounding infrastructure, trust relationships, Windows domain structure.
• Move laterally{{snd}}expand control to other workstations, servers and infrastructure elements and perform data harvesting on them.
• Maintain presence{{snd}}ensure continued control over access channels and credentials acquired in previous steps.
• Complete mission{{snd}}exfiltrate stolen data from victim's network.

In incidents analysed by Mandiant, the average period over which the attackers controlled the victim's network was one year, with longest – almost five years. The infiltrations were allegedly performed by Shanghai-based Unit 61398 of People's Liberation Army. Chinese officials have denied any involvement in these attacks.{{cite web |url=https://www.reuters.com/article/us-china-hacking-idUSBRE91I06120130220 |first=Ben |last=Blanchard |date=2013-02-19 |title=China says U.S. hacking accusations lack technical proof |publisher=Reuters |access-date=14 April 2021 |archive-date=14 April 2021 |archive-url=https://web.archive.org/web/20210414115709/https://www.reuters.com/article/us-china-hacking-idUSBRE91I06120130220 |url-status=live }}

Previous reports from Secdev had previously discovered and implicated Chinese actors.{{cite web| title=Tracking GhostNet: investigating a cyber espionage network| author1=Deibert, R.| author2=Rohozinski, R.| author3=Manchanda, A.| author4=Villeneuve, N.| author5=Walton, G| url=https://ora.ox.ac.uk/objects/uuid:6d1260fd-b8ee-4a11-8a5f-e7708d543651| publisher=The Munk Centre for International Studies, University of Toronto| date=28 March 2009| access-date=27 December 2023| archive-date=27 December 2023| archive-url=https://web.archive.org/web/20231227155852/https://ora.ox.ac.uk/objects/uuid:6d1260fd-b8ee-4a11-8a5f-e7708d543651| url-status=live}}

There are tens of millions of malware variations,{{ cite book | title = GSEC GIAC Security Essentials Certification All |url=https://books.google.com/books?id=zUdZAQAAQBAJ&pg=PR25 | publisher = McGraw Hill Professional, 2013 | author = RicMessier | isbn = 978-0-07-182091-2 | page = xxv | language = en | date = 2013-10-30 }} which makes it extremely challenging to protect organizations from APT. While APT activities are stealthy and hard to detect, the command and control network traffic associated with APT can be detected at the network layer level with sophisticated methods. Deep log analyses and log correlation from various sources is of limited usefulness in detecting APT activities. It is challenging to separate noises from legitimate traffic. Traditional security technology and methods have been ineffective in detecting or mitigating APTs.{{Cite web|title=Anatomy of an APT (Advanced Persistent Threat) Attack|url=https://www.fireeye.com/current-threats/anatomy-of-a-cyber-attack.html|access-date=2020-11-14|website=FireEye|language=en|archive-date=7 November 2020|archive-url=https://web.archive.org/web/20201107220618/https://www.fireeye.com/current-threats/anatomy-of-a-cyber-attack.html|url-status=live}} Active cyber defense has yielded greater efficacy in detecting and prosecuting APTs (find, fix, finish) when applying cyber threat intelligence to hunt and adversary pursuit activities.{{Cite web|date=2015-02-18|title=Threat Intelligence in an Active Cyber Defense (Part 1)|url=https://www.recordedfuture.com/active-cyber-defense-part-1/|access-date=2021-03-10|website=Recorded Future|language=en-US|archive-date=20 June 2021|archive-url=https://web.archive.org/web/20210620155903/https://www.recordedfuture.com/active-cyber-defense-part-1/|url-status=usurped}}{{Cite web|date=2015-02-24|title=Threat Intelligence in an Active Cyber Defense (Part 2)|url=https://www.recordedfuture.com/active-cyber-defense-part-2/|access-date=2021-03-10|website=Recorded Future|language=en-US|archive-date=27 February 2021|archive-url=https://web.archive.org/web/20210227120734/https://www.recordedfuture.com/active-cyber-defense-part-2/|url-status=usurped}} Human-Introduced Cyber Vulnerabilities (HICV) are a weak cyber link that are neither well understood nor mitigated, constituting a significant attack vector.{{Cite web|title=A Context-Centred Research Approach to Phishing and Operational Technology in Industrial Control Systems {{!}} Journal of Information Warfare|url=https://www.jinfowar.com/journal/volume-18-issue-4/context-centred-research-approach-phishing-operational-technology-industrial-control-systems|access-date=2021-07-31|website=www.jinfowar.com|archive-date=31 July 2021|archive-url=https://web.archive.org/web/20210731235144/https://www.jinfowar.com/journal/volume-18-issue-4/context-centred-research-approach-phishing-operational-technology-industrial-control-systems|url-status=live}}

{{See also|Cyberwarfare and China|Chinese information operations and information warfare|Chinese intelligence activity abroad}}

• PLA Unit 61398 (also known as APT1)
• PLA Unit 61486 (also known as APT2)
• Buckeye (also known as APT3){{cite web|url=https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit|date=2019-05-07|title=Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak|publisher=Symantec|url-status=live|archive-url=https://archive.today/20190507054409/https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit|archive-date=2019-05-07|access-date=2019-07-23}}
• Red Apollo (also known as APT10)
• Numbered Panda (also known as APT12)
• DeputyDog (also known as APT17){{cite news |url=https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf |title=APT17: Hiding in Plain Sight - FireEye and Microsoft Expose Obfuscation Tactic |work=FireEye |date=May 2015 |access-date=January 21, 2024 |archive-date=November 24, 2023 |archive-url=https://web.archive.org/web/20231124143647/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf |url-status=live }}
• Dynamite Panda or Scandium (also known as APT18, a unit of the People's Liberation Army Navy){{Cite web |date=August 16, 2023 |title=China-Based Threat Actors |url=https://www.hhs.gov/sites/default/files/china-based-threat-actor-profiles-tlpclear.pdf |url-status=live |archive-url=https://web.archive.org/web/20231229092112/https://www.hhs.gov/sites/default/files/china-based-threat-actor-profiles-tlpclear.pdf |archive-date=29 December 2023 |access-date=29 April 2024 |website=U.S. Department of Health and Human Services Office of Information Security}}
• Codoso Team (also known as APT19)
• Wocao (also known as APT20){{cite web |url=https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf |title=Wocao APT20 |work=fox-it.com |date=2019-12-19 |first1=Maarten |last1=van Dantzig |first2=Erik |last2=Schamper |publisher=NCC Group |access-date=23 December 2019 |archive-date=22 March 2021 |archive-url=https://web.archive.org/web/20210322014904/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf }}{{cite web |last1=Vijayan |first1=Jai |title=China-Based Cyber Espionage Group Targeting Orgs in 10 Countries |url=https://www.darkreading.com/attacks-breaches/china-based-cyber-espionage-group-targeting-orgs-in-10-countries/d/d-id/1336676 |date=December 19, 2019 |website=www.darkreading.com |publisher=Dark Reading |access-date=12 January 2020 |archive-date=May 7, 2021 |archive-url=https://web.archive.org/web/20210507025313/https://www.darkreading.com/attacks-breaches/china-based-cyber-espionage-group-targeting-orgs-in-10-countries/d/d-id/1336676 |url-status=live }}
• APT22 (aka Suckfly){{Cite web |last=Barth |first=Bradley |date=2016-03-16 |title='Suckfly' in the ointment: Chinese APT group steals code-signing certificates |url=https://www.scworld.com/brief/suckfly-in-the-ointment-chinese-apt-group-steals-code-signing-certificates |access-date=2024-09-24 |website=SC Media |language=en |archive-date=September 24, 2024 |archive-url=https://web.archive.org/web/20240924130146/https://www.scworld.com/brief/suckfly-in-the-ointment-chinese-apt-group-steals-code-signing-certificates |url-status=live }}
• APT26 (aka Turbine Panda){{Cite web |title=Building China's Comac C919 airplane involved a lot of hacking, report says |url=https://www.zdnet.com/article/building-chinas-comac-c919-airplane-involved-a-lot-of-hacking-report-says/ |access-date=2024-09-24 |website=ZDNET |language=en |archive-date=November 15, 2019 |archive-url=https://web.archive.org/web/20191115164639/https://www.zdnet.com/article/building-chinas-comac-c919-airplane-involved-a-lot-of-hacking-report-says/ |url-status=live }}
• APT 27{{cite web |last1=Lyngaas |first1=Sean |title=Chinese hackers posed as Iranians to breach Israeli targets, FireEye says |url=https://www.cyberscoop.com/china-israel-iran-fireeye-hacking/ |website=www.cyberscoop.com |date=10 August 2021 |access-date=15 August 2021 |archive-date=November 29, 2023 |archive-url=https://web.archive.org/web/20231129204248/https://cyberscoop.com/china-israel-iran-fireeye-hacking/ |url-status=live }}
• PLA Unit 78020 (also known as APT30 and Naikon)
• Zirconium{{cite web |last1=Lyngaas |first1=Sean |title=Right country, wrong group? Researchers say it wasn't APT10 that hacked Norwegian software firm |url=https://www.cyberscoop.com/apt10-apt31-recorded-future-rapid7-china/ |date=February 12, 2019 |website=www.cyberscoop.com |publisher=Cyberscoop |access-date=16 October 2020 |archive-date=May 7, 2021 |archive-url=https://web.archive.org/web/20210507025345/https://www.cyberscoop.com/apt10-apt31-recorded-future-rapid7-china/ |url-status=live }} (also known as APT31 and Violet Typhoon){{cite web |last1=Lyngaas |first1=Sean |title=Google offers details on Chinese hacking group that targeted Biden campaign |url=https://www.cyberscoop.com/biden-chinese-hacking-google-security-russia/ |date=October 16, 2020 |website=Cyberscoop |access-date=16 October 2020 |archive-date=May 7, 2021 |archive-url=https://web.archive.org/web/20210507025313/https://www.cyberscoop.com/biden-chinese-hacking-google-security-russia/ |url-status=live }}{{cite web |title=How Microsoft names threat actors |date=January 16, 2024 |url=https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming |publisher=Microsoft |access-date=21 January 2024 |archive-date=July 10, 2024 |archive-url=https://web.archive.org/web/20240710235817/https://learn.microsoft.com/en-us/defender-xdr/microsoft-threat-actor-naming |url-status=live }}{{Cite web |date=2024-03-19 |title=Treasury Sanctions China-Linked Hackers for Targeting U.S. Critical Infrastructure |url=https://home.treasury.gov/news/press-releases/jy2205 |access-date=2024-03-25 |website=U.S. Department of the Treasury |language=en |archive-date=March 25, 2024 |archive-url=https://web.archive.org/web/20240325174521/https://home.treasury.gov/news/press-releases/jy2205 |url-status=live }}
• APT40
• Double Dragon{{cite web |url=https://content.fireeye.com/apt-41/rpt-apt41/ |title=Double Dragon APT41, a dual espionage and cyber crime operation |work=FireEye |date=2019-10-16 |access-date=2020-04-14 |archive-date=May 7, 2021 |archive-url=https://web.archive.org/web/20210507025313/https://content.fireeye.com/apt-41/rpt-apt41/ |url-status=dead }} (also known as APT41, Winnti Group, Barium, or Axiom){{cite web |date=May 17, 2020 |title=Bureau names ransomware culprits |url=https://www.taipeitimes.com/News/taiwan/archives/2020/05/17/2003736564 |url-status=live |archive-url=https://web.archive.org/web/20210322015319/https://www.taipeitimes.com/News/taiwan/archives/2020/05/17/2003736564 |archive-date=March 22, 2021 |access-date=22 May 2020 |website=Taipei Times |publisher=}}{{Cite magazine |last=Greenberg |first=Andy |author-link=Andy Greenberg |date=August 6, 2020 |title=Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry |url=https://www.wired.com/story/chinese-hackers-taiwan-semiconductor-industry-skeleton-key/ |url-status=live |archive-url=https://web.archive.org/web/20210322015355/https://www.wired.com/story/chinese-hackers-taiwan-semiconductor-industry-skeleton-key/ |archive-date=March 22, 2021 |access-date=2024-07-14 |magazine=Wired |language=en-US |issn=1059-1028}}
• Spamouflage (also known as Dragonbridge or Storm 1376){{Cite news |last=Sabin |first=Sam |date=October 26, 2022 |title=New pro-China disinformation campaign targets 2022 elections: Report |work=Axios |url=https://www.axios.com/2022/10/26/disinformation-campaign-midterms-china-dragonbridge-mandiant |access-date=October 27, 2022 |archive-date=October 26, 2022 |archive-url=https://web.archive.org/web/20221026182732/https://www.axios.com/2022/10/26/disinformation-campaign-midterms-china-dragonbridge-mandiant |url-status=live }}{{Cite news |last=Milmo |first=Dan |date=2024-04-05 |title=China will use AI to disrupt elections in the US, South Korea and India, Microsoft warns |url=https://www.theguardian.com/technology/2024/apr/05/china-using-ai-disrupt-elections |access-date=2024-04-07 |work=The Guardian |language=en-GB |issn=0261-3077 |archive-date=May 25, 2024 |archive-url=https://web.archive.org/web/20240525185211/https://www.theguardian.com/technology/2024/apr/05/china-using-ai-disrupt-elections |url-status=live }}
• Hafnium{{cite web |last=Naraine |first=Ryan |title=Microsoft: Multiple Exchange Server Zero-Days Under Attack by Chinese Hacking Group |date=2021-03-02 |language=English |url=https://www.securityweek.com/microsoft-4-exchange-server-zero-days-under-attack-chinese-apt-group |website=securityweek.com |publisher=Wired Business Media |access-date=2021-03-03 |archive-date=July 6, 2023 |archive-url=https://web.archive.org/web/20230706202313/https://www.securityweek.com/microsoft-4-exchange-server-zero-days-under-attack-chinese-apt-group/ |url-status=live }}{{cite web |last=Burt |first=Tom |title=New nation-state cyberattacks |date=2021-03-02 |language=English |url=https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/ |website=blogs.microsoft.com |publisher=Microsoft |access-date=2021-03-03 |archive-date=March 2, 2021 |archive-url=https://web.archive.org/web/20210302211855/https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/ |url-status=live }}
• LightBasin{{Cite web |url=https://www.techtarget.com/searchsecurity/news/252508413/LightBasin-hackers-spent-5-years-hiding-on-telco-networks |title='LightBasin' hackers spent 5 years hiding on telco networks |date=2021-10-20 |access-date=2022-04-08 |website=TechTarget |last=Nichols |first=Shaun |archive-date=November 29, 2023 |archive-url=https://web.archive.org/web/20231129204219/https://www.techtarget.com/searchsecurity/news/252508413/LightBasin-hackers-spent-5-years-hiding-on-telco-networks |url-status=live }}{{Cite web |url=https://www.bleepingcomputer.com/news/security/lightbasin-hacking-group-breaches-13-global-telecoms-in-two-years/ |title=LightBasin hacking group breaches 13 global telecoms in two years |date=2021-10-19 |access-date=2022-04-08 |website=Bleeping Computer |last=Ilascu |first=Ionut |archive-date=July 24, 2023 |archive-url=https://web.archive.org/web/20230724084013/https://www.bleepingcomputer.com/news/security/lightbasin-hacking-group-breaches-13-global-telecoms-in-two-years/ |url-status=live }} (Also known as UNC1945)
• Tropic Trooper{{cite news |last1=Cimpanu |first1=Catalin |title=Hackers target the air-gapped networks of the Taiwanese and Philippine military |url=https://www.zdnet.com/article/hackers-target-the-air-gapped-networks-of-the-taiwanese-and-philippine-military/ |website=ZDnet |access-date=16 May 2020 |archive-date=March 22, 2021 |archive-url=https://web.archive.org/web/20210322015315/https://www.zdnet.com/article/hackers-target-the-air-gapped-networks-of-the-taiwanese-and-philippine-military/ |url-status=live }}
• Volt Typhoon{{Cite web |last=Intelligence |first=Microsoft Threat |date=2023-05-24 |title=Volt Typhoon targets US critical infrastructure with living-off-the-land techniques |url=https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ |access-date=2023-05-26 |website=Microsoft Security Blog |language=en-US |archive-date=January 17, 2024 |archive-url=https://web.archive.org/web/20240117093138/https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ |url-status=live }}
• Flax Typhoon{{Cite web |last=Tucker |first=Eric |date=2024-09-18 |title=FBI disrupts Chinese cyber operation targeting critical infrastructure in the US |url=https://apnews.com/article/fbi-justice-department-chinese-hacking-84e16185ae16367443a5e083adb74c8c |access-date=2024-09-18 |website=Associated Press |language=en |archive-date=September 24, 2024 |archive-url=https://web.archive.org/web/20240924130146/https://apnews.com/article/fbi-justice-department-chinese-hacking-84e16185ae16367443a5e083adb74c8c |url-status=live }}
• Charcoal Typhoon (also known as CHROMIUM){{cite web|url=https://openai.com/blog/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors|title=Disrupting malicious uses of AI by state-affiliated threat actors|date=February 14, 2024|access-date=February 16, 2024|archive-date=February 16, 2024|archive-url=https://web.archive.org/web/20240216151959/https://openai.com/blog/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors|url-status=live}}{{cite web|url=https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai|title=Staying ahead of threat actors in the age of AI|website=Microsoft|date=February 14, 2024|access-date=February 16, 2024|archive-date=February 16, 2024|archive-url=https://web.archive.org/web/20240216163312/https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/|url-status=live}}
• Salmon Typhoon (also known as SODIUM)
• Salt Typhoon (also known as GhostEmperor or FamousSparrow){{Cite news |last1=Krouse |first1=Sarah |last2=McMillan |first2=Robert |last3=Volz |first3=Dustin |date=September 25, 2024 |title=China-Linked Hackers Breach U.S. Internet Providers in New 'Salt Typhoon' Cyberattack |url=https://www.wsj.com/politics/national-security/china-cyberattack-internet-providers-260bd835 |url-access=subscription |access-date=September 25, 2024 |work=The Wall Street Journal |archive-date=7 October 2024 |archive-url=https://archive.today/20241007181947/https://www.wsj.com/politics/national-security/china-cyberattack-internet-providers-260bd835 |url-status=live }}{{Cite news |last1=Krouse |first1=Sarah |last2=Volz |first2=Dustin |last3=Viswanatha |first3=Aruna |last4=McMillan |first4=Robert |date=October 5, 2024 |title=U.S. Wiretap Systems Targeted in China-Linked Hack |url=https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b |url-access=subscription |url-status=live |archive-url=https://web.archive.org/web/20241005025020/https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b |archive-date=October 5, 2024 |access-date=October 5, 2024 |work=The Wall Street Journal}}
• Liminal Panda{{Cite news |last=Sabin |first=Sam |date=November 19, 2024 |title=New China-linked telco attackers |url=https://www.axios.com/2024/11/19/exclusive-new-china-linked-telco-attackers-codebook |access-date=November 19, 2024 |work=Axios}}
• MirrorFace{{Cite web |last=Yamaguchi |first=Mari |date=2025-01-08 |title=Japan links Chinese hacker MirrorFace to dozens of cyberattacks targeting security and tech data |url=https://apnews.com/article/japan-police-cyberattack-china-government-68adcb293b2931da4c30ca0279720124 |access-date=2025-01-08 |website=Associated Press |language=en |archive-date=8 January 2025 |archive-url=https://web.archive.org/web/20250108182344/https://apnews.com/article/japan-police-cyberattack-china-government-68adcb293b2931da4c30ca0279720124 |url-status=live }}

• Charming Kitten (also known as APT35)
• Elfin Team (also known as APT33)
• Helix Kitten (also known as APT34)
• Pioneer Kitten{{Cite web|last=Montalbano|first=Elizabeth|url=https://threatpost.com/pioneer-kitten-apt-sells-corporate-network-access/158833/|title=Pioneer Kitten APT Sells Corporate Network Access|website=Threat Post|date=September 1, 2020|access-date=3 September 2020|archive-date=22 March 2021|archive-url=https://web.archive.org/web/20210322015301/https://threatpost.com/pioneer-kitten-apt-sells-corporate-network-access/158833/|url-status=live}}
• Remix Kitten (also known as APT39, ITG07, or Chafer){{Cite web |title=APT39, ITG07, Chafer, Remix Kitten, Group G0087 {{!}} MITRE ATT&CK® |url=https://attack.mitre.org/groups/G0087/ |access-date=2022-12-30 |website=attack.mitre.org |archive-date=30 December 2022 |archive-url=https://web.archive.org/web/20221230215710/https://attack.mitre.org/groups/G0087/ |url-status=live }}{{Cite web |date=2020 |title=Crowdstrike Global Threat Report 2020 |url=https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf|access-date=2020-12-30 |website=crowdstrike.com|archive-url=https://web.archive.org/web/20200314121317/https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf|archive-date=2020-03-14|url-status=live}}

• Kimsuky
• Lazarus Group (also known as APT38)
• Ricochet Chollima (also known as APT37)

• Berserk Bear
• Cozy Bear (also known as APT29)
• Fancy Bear (also known as APT28)
• FIN7
• Gamaredon{{cite web|title=Microsoft discloses new details on Russian hacker group Gamaredon|author=Kyle Alspach|work=VentureBeat|date=4 February 2022|access-date=22 March 2022|url=https://venturebeat.com/2022/02/04/microsoft-discloses-new-details-on-russian-hacker-group-gamaredon/|archive-date=6 February 2022|archive-url=https://web.archive.org/web/20220206082258/https://venturebeat.com/2022/02/04/microsoft-discloses-new-details-on-russian-hacker-group-gamaredon/|url-status=live}} (also known as Primitive Bear){{efn|active since 2013, unlike most APTs, Gamaredon broadly targets all users all over the globe (in addition to also focusing on certain victims, especially Ukrainian organizations) and appears to provide services for other APTs.{{cite web|title=Gamaredon - When nation states don't pay all the bills|author1=Warren Mercer|author2=Vitor Ventura|work=Cisco|date=23 February 2021|access-date=22 March 2022|url=https://blog.talosintelligence.com/2021/02/gamaredonactivities.html|archive-date=19 March 2022|archive-url=https://web.archive.org/web/20220319134527/https://blog.talosintelligence.com/2021/02/gamaredonactivities.html|url-status=live}} For example, the InvisiMole threat group has attacked select systems that Gamaredon had earlier compromised and fingerprinted.{{cite web|title=Ukraine warns of InvisiMole attacks tied to state-sponsored Russian hackers|author=Charlie Osborne|website=ZDNet|date=21 March 2022|access-date=22 March 2022|url=https://www.zdnet.com/article/ukraine-warns-of-invisimole-attacks-tied-to-state-sponsored-russian-hackers/|archive-date=22 March 2022|archive-url=https://web.archive.org/web/20220322165716/https://www.zdnet.com/article/ukraine-warns-of-invisimole-attacks-tied-to-state-sponsored-russian-hackers/|url-status=live}}}}
• Sandworm (also known as APT44)
• Venomous Bear{{Cite web |title=Adversary: Venomous Bear - Threat Actor |url=https://adversary.crowdstrike.com/en-US/adversary/venomous-bear/ |access-date=2022-03-22 |website=Crowdstrike Adversary Universe |language=en-US}}

• StrongPity (also known as APT-C-41 or PROMETHIUM){{cite web|title=PROMETHIUM extends global reach with StrongPity3 APT|author1=Warren Mercer|author2=Paul Rascagneres|author3=Vitor Ventura|work=Cisco|date=29 June 2020|access-date=22 March 2022|url=https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html|archive-date=22 March 2022|archive-url=https://web.archive.org/web/20220322224729/https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html|url-status=live}}

• Equation Group{{cite web|url=https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/|title=Equation: The Death Star of Malware Galaxy|date=2015-02-16|access-date=2019-07-23|archive-date=2019-07-11|url-status=live|archive-url=https://web.archive.org/web/20190711082936/https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/|publisher=Kaspersky Lab}}

• SandCat, associated with the State Security Service according to Kaspersky{{cite web |last1=Gallagher |first1=Sean |title=Kaspersky finds Uzbekistan hacking op… because group used Kaspersky AV |url=https://arstechnica.com/information-technology/2019/10/kaspersky-finds-uzbekistan-hacking-opbecause-they-used-kaspersky-av/ |website=arstechnica.com |date=3 October 2019 |publisher=Ars Technica |access-date=5 October 2019 |archive-date=22 March 2021 |archive-url=https://web.archive.org/web/20210322015356/https://arstechnica.com/information-technology/2019/10/kaspersky-finds-uzbekistan-hacking-opbecause-they-used-kaspersky-av/ |url-status=live }}

• OceanLotus (also known as APT32){{cite web |last1=Panda |first1=Ankit |title=Offensive Cyber Capabilities and Public Health Intelligence: Vietnam, APT32, and COVID-19 |url=https://thediplomat.com/2020/04/offensive-cyber-capabilities-and-public-health-intelligence-vietnam-apt32-and-covid-19/ |website=thediplomat.com |publisher=The Diplomat |access-date=29 April 2020 |archive-date=22 March 2021 |archive-url=https://web.archive.org/web/20210322015324/https://thediplomat.com/2020/04/offensive-cyber-capabilities-and-public-health-intelligence-vietnam-apt32-and-covid-19/ |url-status=live }}{{cite news |title=Lined up in the sights of Vietnamese hackers |url=https://web.br.de/interaktiv/ocean-lotus/en/ |first1=Hakan |last1=Tanriverdi |first2=Max |last2=Zierer |first3=Ann-Kathrin |last3=Wetter |first4=Kai |last4=Biermann |first5=Thi Do |last5=Nguyen |publisher=Bayerischer Rundfunk |date=October 8, 2020 |editor-first=Verena |editor-last=Nierle |editor2-first=Robert |editor2-last=Schöffel |editor3-first=Lisa |editor3-last=Wreschniok |quote=In Bui's case the traces lead to a group presumably acting on behalf of the Vietnamese state. Experts have many names for this group: APT 32 and Ocean Lotus are best known. In conversations with a dozen of information security specialists, they all agreed that this is a Vietnamese group spying, in particular, on its own compatriots. |access-date=11 October 2020 |archive-date=22 March 2021 |archive-url=https://web.archive.org/web/20210322015304/https://web.br.de/interaktiv/ocean-lotus/en/ |url-status=live }}

• Appin{{Cite web |title=APT Attacks Trace To India, Researcher Says |url=https://www.darkreading.com/cyberattacks-data-breaches/apt-attacks-trace-to-india-researcher-says |access-date=2025-04-28 |website=www.darkreading.com |language=en}}

Multiple organizations may assign different names to the same actor. As separate researchers could each have their own varying assessments of an APT group, companies such as CrowdStrike, Kaspersky, Mandiant, and Microsoft, among others, have their own internal naming schemes.{{cite web |author=BushidoToken |title=Threat Group Naming Schemes In Cyber Threat Intelligence |date=20 May 2022 |url=https://www.curatedintel.org/2022/05/threat-group-naming-schemes-in-cyber.html |publisher=Curated Intelligence |access-date=21 January 2024 |archive-date=8 December 2023 |archive-url=https://web.archive.org/web/20231208025624/https://www.curatedintel.org/2022/05/threat-group-naming-schemes-in-cyber.html |url-status=live }} Names between different organizations may refer to overlapping but ultimately different groups, based on various data gathered.

CrowdStrike assigns animals by nation-state or other category, such as "Kitten" for Iran and "Spider" for groups focused on cybercrime.{{cite web |title=CrowdStrike 2023 Global Threat Report |url=https://iitd.com.ua/wp-content/uploads/2023/03/crowdstrike2023globalthreatreport.pdf |publisher=CrowdStrike |access-date=21 January 2024 |archive-date=26 March 2024 |archive-url=https://web.archive.org/web/20240326233326/https://iitd.com.ua/wp-content/uploads/2023/03/crowdstrike2023globalthreatreport.pdf |url-status=live }} Other companies have named groups based on this system {{emdash}} Rampant Kitten, for instance, was named by Check Point rather than CrowdStrike.{{cite web |title=Rampant Kitten |url=https://apt.etda.or.th/cgi-bin/showcard.cgi?g=Rampant%20Kitten |publisher=Thailand Electronic Transactions Development Agency |access-date=21 January 2024 |archive-date=29 November 2022 |archive-url=https://web.archive.org/web/20221129105244/https://apt.etda.or.th/cgi-bin/showcard.cgi?g=Rampant%20Kitten |url-status=live }}

Dragos bases its names for APT groups on minerals.

Mandiant assigns numbered acronyms in three categories, APT, FIN, and UNC, resulting in APT names like FIN7. Other companies using a similar system include Proofpoint (TA) and IBM (ITG and Hive).

Microsoft used to assign names from the periodic table, often stylized in all-caps (e.g. POTASSIUM); in April 2023, Microsoft changed its naming schema to use weather-based names (e.g. Volt Typhoon).{{cite web |last1=Lambert |first1=John |title=Microsoft shifts to a new threat actor naming taxonomy |url=https://www.microsoft.com/en-us/security/blog/2023/04/18/microsoft-shifts-to-a-new-threat-actor-naming-taxonomy/ |publisher=Microsoft |access-date=21 January 2024 |date=April 18, 2023 |archive-date=22 January 2024 |archive-url=https://web.archive.org/web/20240122164844/https://www.microsoft.com/en-us/security/blog/2023/04/18/microsoft-shifts-to-a-new-threat-actor-naming-taxonomy/ |url-status=live }}

{{div col|colwidth=20em}}

• Bureau 121
• Chinese intelligence activity abroad
• Cyber spying
• Darkhotel
• Fileless malware
• Ghostnet
• Kill chain
• NetSpectre
• Operation Aurora
• Operation Shady RAT
• Proactive cyber defence
• Spear-phishing
• Spyware
• Stuxnet
• Tailored Access Operations
• Unit 180
• Unit 8200

{{div col end}}

{{Notelist}}

{{Reflist}}

; Lists of APT groups

• [https://www.mandiant.com/resources/insights/apt-groups Mandiant: Advanced Persistent Threat Groups]
• [https://attack.mitre.org/groups/ MITRE ATT&CK security community tracked Advanced Persistent Group Pages]

{{Information security|state=12.12.2000}}

Category:Espionage

Category:Hacking (computer security)

Category:Cyberwarfare