Advanced Persistent Threat (APT).

What is an advanced persistent threat?

An advanced persistent threat, or APT, is a skilled and well-funded adversary that works against a target over a long period. NIST describes it as an adversary with sophisticated levels of expertise and significant resources. CISA says APT actors are well-resourced and engage in sophisticated malicious cyber activity that is targeted and aimed at prolonged network or system intrusion.

The word “advanced” points to expertise and resources. The word “persistent” points to the long time frame and the effort to stay in place.

How does an advanced persistent threat work?

NIST says an APT uses multiple different attack vectors, such as cyber, physical and deception, to create opportunities to reach its objectives. An attack vector is a route an attacker uses to reach a target.

According to NIST, the typical objectives are to establish and extend a presence inside the information technology of organizations. From there, the aim is to keep exfiltrating information, which means copying data out of the organization. The aim can also be to undermine or impede critical parts of a mission, program or organization, or to be in a position to do so in the future.

NIST adds that an APT pursues its objectives repeatedly over an extended period of time. It adapts to a defender’s efforts to resist it. It also shows determination to keep the level of interaction it needs.

What do these threats usually want?

CISA says APT operations are aimed at espionage, data theft, and the disruption or destruction of infrastructure. The NIST wording is broader and also covers staying in place for future use.

A simple illustration

This is a generic illustration, not a real case. An organization finds that an outsider has gained a foothold in its network. Removing the visible problem is not the end of it, because an APT can adapt to the defender’s efforts and keep trying over an extended period.

How can organizations reduce the risk?

CISA gives several steps on its APT page. They are listed here as CISA states them.

• Implement the Cybersecurity Performance Goals (CPGs).
• Prioritize mitigation of known exploited vulnerabilities.
• Address the top network misconfigurations that CISA lists.
• Prioritize command-line logging and monitor high-risk ports such as RDP and SMB.
• Apply the principle of least privilege by defining privileged administrator actions and locations to a manageable baseline.
• Establish a baseline of normal host behavior and user activity, so that anomalous activity on endpoints can be spotted when reviewing logs.
• Report suspicious activity to CISA or the FBI.

CISA also says that signing up for its cybersecurity alerts and advisories gives timely notice of emerging campaigns, and its no-cost scanning service gives early warning of exploited vulnerabilities.

How does it relate to nearby terms?

Related terms are cyber espionage, tactics, techniques and procedures, and threat intelligence. Each has its own page in this glossary.

Is an APT the same as a single piece of malware?

No. NIST defines an APT as an adversary, meaning the actor behind the activity. It is not a tool or a single piece of software.

Is an APT the same as an APT group?

The two terms are often used in the same way. NIST says an APT can be an adversary or a collection of adversaries, so “APT group” can describe a collection of adversaries working together.

Does an APT always aim to steal data?

No. Data theft is one aim. NIST also lists undermining or impeding a mission, and CISA lists disruption or destruction of infrastructure.

In Singapore, a committee of inquiry found that the attacker in the 2018 SingHealth case had the characteristics of an APT group, and the Cyber Security Agency calls the actor in the 2025 telecoms campaign a state-sponsored APT group.