Advanced Persistent Threat

What Is Advanced Persistent Threat?

An Advanced Persistent Threat (APT) is a highly sophisticated and sustained cyberattack where an intruder infiltrates a network and maintains an undetected presence over an extended period. The term "advanced" signifies that APT attacks involve high levels of customization and complexity compared to traditional attacks. They necessitate significant time and resources for researching and identifying system vulnerabilities. The term "persistent" indicates that attackers continuously monitor their target, maintaining long-term access to achieve specific objectives. The word "threat" highlights that these attacks are meticulously planned and aimed at high-value organizations. When successful, APT attacks can result in substantial economic losses, political repercussions, or even catastrophic damage to the target.

APT attacks are meticulously planned and researched, targeting large enterprises or governmental networks. The consequences of these intrusions are extensive such as intellectual property theft, compromised sensitive information, sabotage of critical infrastructures and total site takeovers.

Executing an APT attack demands more resources than a standard web application attack. The perpetrators are typically teams of skilled cybercriminals with substantial financial support. Some APT attacks are government-funded, serving as tools for cyber warfare.

The Kill Chain Process in Advanced Persistent Threats

An APT attacker is typically an organization that follows a multi-phase process known as a "kill chain" in the security domain. This process begins by targeting a victim and aims to achieve ultimate success through several stages. While different vendors may define the kill chain process with slight variations, the overall methodology remains consistent.

Stage 1: Information Collection

After selecting a target, the attacker collects extensive intelligence about it. This information may include the organization's structure, office locations, products and services, employee contact lists, management email addresses, executive meeting schedules, portal directory layouts, internal network architecture, deployed security devices, open ports, operating systems used in the office, email systems used by employees, and the OS and version of the corporate web server.

Stage 2: External Penetration

Upon accumulating this data, the attacker proceeds to explore various avenues for infiltrating the organization, evaluating whether to initiate with phishing emails, target web servers, or USB flash drives. When it comes to phishing emails, the attacker scrutinizes which zero-day vulnerability in client software to exploit. For web server infiltration, the attacker pinpoints the websites frequented by target users.

With the means of penetration identified, the subsequent step involves crafting specific malware. Typically, the attacker's organization comprises a dedicated team focused on zero-day exploits, continuously monitoring key vulnerability reporting platforms. By leveraging publicly or semi-publicly disclosed vulnerabilities and potential proof-of-concept code, the attackers develop their own malware, embedding malicious code (known as shellcode) into PDF or Microsoft Office files. Such malware incorporates anti-detection measures like code obfuscation, shelling, and encryption. Moreover, to evade detection, the attackers often subject the malware to scans using the latest antivirus software before deploying it to the target network.

Once the malware is prepared, the next phase entails delivering it to the target network. Common delivery methods include email attachments, websites (containing embedded Trojan horses), and USB flash drives.

• In phishing email attacks, meticulous construction of an email is essential, encompassing the email content, subject line, and attachment details, all designed to lure the recipient into clicking the attachment or URL embedded in the email body. For instance, phishing emails and counterfeit files related to the COVID-19 pandemic became prevalent tactics for APTs in 2020.

• Regarding websites with embedded Trojan horses, the attacker selects a legitimate website based on the interests of the target. This website must harbor zero-day vulnerabilities exploitable by the attacker to infiltrate and compromise it. Subsequently, upon gaining access, the attacker implants a script capable of automatic background downloading. Consequently, unsuspecting visitors inadvertently download the malware to their local devices, where it exploits browser vulnerabilities for installation and execution.

• USB flash drive attacks involve loading malware onto a USB flash drive, with the anticipation that target individuals will insert the drive into their local computers. This method is typically employed when targets lack network connectivity, but it necessitates close physical proximity to the targets.

Stage 3: Command and Control

Upon a target user executing a vulnerable client program or accessing a file with malicious code via a browser, the said code initiates the download and installation of malware by exploiting the identified vulnerability. Typically, this malware is a compact remote control tool known as a remote administration tool or remote access Trojan (RAT) in industry parlance. Its primary function is to establish a command and control (C&C) channel to a designated control server. Additionally, the malware commonly elevates privileges or creates an administrator account, ensuring it launches during device startup. Furthermore, it discreetly adjusts or disables host firewall settings in the background to evade detection.

Stage 4: Internal Spread

In an organization, office hosts commonly operate within comparable application environments, often running identical operating systems. Consequently, they share similar vulnerabilities. Once an intranet host is compromised, malware propagates horizontally to other hosts on the same subnet or vertically to internal servers within the enterprise. Leveraging the RAT, attackers gain access to key logging and screen recording functionalities, simplifying the extraction of user domain passwords, email credentials, and various server access codes from the victim.

Stage 5: Data Breach

To evade detection, attackers frequently leverage anonymous networks and encrypted communication channels, diligently covering their tracks throughout each stage of the attack. Employing various technical tactics, they aim to thwart detection by network security devices when transmitting sensitive information. For instance, attackers may fragment, encrypt, or obfuscate data to circumvent detection by data loss prevention (DLP) systems, which typically employ keyword scanning to uncover breaches. Additionally, attackers may regulate packet transmission rates to avoid surpassing detection thresholds set on diverse security devices.

Unique Characteristics of Advanced Persistent Threats

• Methodical Perpetrators: APT attacks are orchestrated by highly organized entities, often with military or political affiliations and substantial financial backing.

• Selective Targets: Attackers meticulously choose their targets, typically focusing on entities of significant military, political, or economic importance.

• Advanced Techniques: APT assaults employ sophisticated tactics, utilizing multiple iterations of malicious code and exploiting zero-day vulnerabilities. Consequently, conventional defense mechanisms reliant on signature matching struggle to effectively identify these attacks.

• Concealed Operations: APT perpetrators prioritize stealth, avoiding overtly disruptive tactics like DDoS attacks. This makes traditional traffic-based defenses less effective, as advanced evasion techniques are employed to evade detection by security systems. Throughout the attack, the system exhibits no obvious abnormalities, making real-time or short-term anomaly detection challenging.

• Long-Term Persistence: APT attackers demonstrate patience, persistently infiltrating and exfiltrating data over extended periods, often spanning months or even years.

Advanced Persistent Threat Examples

Here are some instances of APT malware-driven assaults and notable APT groups:

• GhostNet: Operating from China, this group utilized spear phishing emails carrying malware. They infiltrated computers in over 100 nations, particularly targeting government ministries and embassies. Once compromised, they activated cameras and microphones, effectively turning devices into surveillance tools.

• Stuxnet: This worm was designed to disrupt Iran's nuclear program, spread via infected USB devices. It caused damage to uranium-enriching centrifuges by targeting SCADA systems, all without operators' awareness.

• Deep Panda: Suspected to originate from China, Deep Panda targeted the US Government's Office of Personnel Management in a significant 2015 breach, compromising over 4 million personnel records, potentially including details of secret service staff.

• APT28: Also known as Fancy Bear, Pawn Storm, and Sednit, this Russian group, identified in 2014 by Trend Micro, launched attacks against military and government entities in Ukraine and Georgia, NATO bodies, and US defense contractors.

• APT34: Linked to Iran, FireEye researchers identified this group in 2017, targeting government bodies and various industries like finance, energy, chemicals, and telecommunications in the Middle East.

• APT37: Also recognized as Reaper and StarCruft, this North Korean group, active since 2012, is associated with spear phishing campaigns exploiting the Adobe Flash zero-day vulnerability.

APT Detection and Protection Measures

Detecting and defending against APTs requires a multifaceted approach encompassing various security tools and strategies:

• Email filtering: Given that many APT attacks begin with phishing emails, robust email filtering systems are crucial. These systems can detect and block malicious links or attachments, thwarting initial access attempts.

• Endpoint protection: APTs typically involve compromising endpoint devices. Advanced anti-malware solutions and Endpoint Detection and Response (EDR) tools can detect and respond to endpoint compromises by APT actors.

• Access control: Implementing stringent authentication measures and closely managing user accounts, especially privileged ones, can mitigate the risk of APT infiltration.

• Monitoring network traffic and user behavior: Continuous monitoring of network traffic, as well as user and entity behavior, can aid in identifying various stages of an APT attack, including initial penetration, lateral movement, and data exfiltration. Advanced security analytics and User and Entity Behavior Analytics (UEBA) can provide insights into suspicious activities indicative of APT activity.