---
title: What are Advanced Persistent Threats (APT)?
url: https://www.broadcom.com/topics/advanced-persistent-threats
description: Learn about Advanced Persistent Threats (APT), which are targeted, sustained cyberattacks.
---

# What are Advanced Persistent Threats (APT)?

An Advanced Persistent Threat (APT) is a targeted and sustained cyberattack where an unauthorized entity establishes a persistent presence within a system, aiming to execute its malicious objectives over an extended period.

Advanced Persistent Threats (APTs) pose a significant and expensive risk. Unlike typical [malware](https://www.broadcom.com/topics/malware), APTs employ a strategic, stealthy methodology. Historically, infiltration methods included Trojans or phishing, but there's a growing trend towards exploiting known vulnerabilities in unpatched, public-facing systems. Attackers also gain access using valid credentials, often acquired through data leaks or due to organizations using weak or default credentials. Once inside, they covertly navigate the network to deploy malicious software. Their ultimate objective is to continuously exfiltrate data, a process that can span months or even years.

## Advanced Persistent Threat stages

Attackers executing APTs have a standard, sequential attack approach to achieve their goals. Here is a quick summary of the typical stages they go through:

1. **Develop a specific target:** APT attackers always identify the organization and data they want to acquire.
2. **Gain access:** Attacks typically employ a range of methods. Social engineering tactics are often used to pinpoint susceptible targets, followed by spear phishing emails or malware from popular websites to compromise credentials and network access. Currently, the primary entry point into organizations involves exploiting known vulnerabilities in unpatched, internet-facing systems. Valid credentials are also frequently used, either obtained from data leaks or through organizations utilizing weak or default credentials.
3. **Establish control:** Once able to access the network, APT attackers typically attempt to establish command and control. Once they establish a presence in the network, attackers then move laterally and freely throughout the environment, exploring and planning an attack strategy for the desired data.
4. **Stage the attack:** The next stage is to prepare the targeted data for exfiltration by centralizing, encrypting, and compressing it.
5. **Take the data:** At this point, the data can be stealthily and easily exfiltrated and moved globally, typically without being detected.
6. **Persist until detected:** This process is repeated for long periods of time through the attackers’ hidden stronghold until finally detected.

## Advanced Persistent Threat examples

View more information and publications on APTs by visiting Broadcom’s cybersecurity-focused website [security.com](https://www.security.com).

Some notable Advanced Persistent Threats (APTs) Symantec has identified over time include (listed alphabetically):

- Daxin
- Dragonfly
- Hidden Lynx
- Regin
- Stuxnet

## How to detect an Advanced Persistent Threat

Proactive APT detection involves looking for command shells (WMI, CMD, PowerShell), establishing network connections, or using remote administration tools on non-admin systems. New processes, spawned command shells, deviations in admin account behavior, new local or domain accounts, or Windows processes (lsass, svchost, csrss) with unusual parents can also signal an APT.

Because most APTs exfiltrate data, attackers leave behind evidence of malicious activity. Here are some of the most telling indicators of an APT:

- Increased logins at irregular hours
- Discoveries of backdoor Trojan programs
- Large and unexplainable data flows
- Unexpected bundles of aggregated data
- Discoveries of pass-the-hash hacking tools
- Detections of spear-phishing in PDF files

## Recommended for You

## How to protect against Advanced Persistent Threats

Organizations can better protect against APT attacks using available cybersecurity and intelligence solutions. Common prevention methods for organizations include:

- Implement proper audit and control of administrative account usage. Another option could be to implement one-time credentials for admin work to help prevent theft and misuse of admin credentials.
- Audit all software on public-facing systems and prioritize immediate patching when security updates are made. Attackers can begin scanning for vulnerable systems within hours of updates being released.
- Create profiles of usage for admin tools. Many of these tools are used by attackers to move laterally undetected through a network.
- Monitor for the use of known-use tools inside your network.
- Use application allowlisting where applicable.
- Employ multi-factor authentication (MFA). This can help limit the usefulness of compromised credentials.
- Make credential dumping difficult, for example, by enabling Credential Guard in Windows 10 or disabling SeDebugPrivilege.
- Restrict access to Remote Desktop Protocol (RDP) Services. Only allow RDP from specific known IP addresses with MFA.
- Ensure you have the latest version of PowerShell with logging enabled. Locking down PowerShell with constrained language mode can also increase security.

## How Broadcom can help

Organizations need a defense-in-depth strategy, using multiple detection, protection, and hardening technologies to mitigate risk at each point of a potential attack chain. Whether your organization is cloud-native or is going to deploy in an on-premises data center or even a cloud, Symantec’s [Endpoint Security and Management](https://www.broadcom.com/products/cybersecurity/endpoint/management), and Carbon Black’s [Endpoint](https://www.broadcom.com/products/carbon-black/threat-prevention/endpoint-protection) and [Threat Detection and Response](https://www.broadcom.com/products/carbon-black/threat-detection-and-response) products can deliver a cybersecurity solution that hardens infrastructure for the long term.

### Recommended for You

- [Threat Intelligence](https://www.broadcom.com/topics/threat-intelligence)
- [Endpoint Security](https://www.broadcom.com/topics/endpoint-security)

## Recommended for You

- [Threat Intelligence](https://www.broadcom.com/topics/threat-intelligence)
- [Endpoint Security](https://www.broadcom.com/topics/endpoint-security)

## Related Products and Solutions

- [Symantec Endpoint Security Complete](https://www.broadcom.com/products/cybersecurity/endpoint/end-user/complete)
- [Carbon Black Endpoint](https://www.broadcom.com/products/carbon-black/threat-prevention/endpoint-protection)
- [Carbon Black EDR](https://www.broadcom.com/products/carbon-black/threat-detection-and-response/endpoint-detection-and-response)