Advanced Persistent Threats Defined in Plain Terms
An advanced persistent threat, or APT, is a prolonged and targeted cyberattack in which a skilled, well-resourced intruder breaks into a network and stays hidden for a long time. The goal is not a quick payout but long-term access, used to steal information, prepare sabotage or move deeper into connected systems.
The most widely cited advanced persistent threat definition comes from the US National Institute of Standards and Technology (NIST) which describes an APT as an adversary with sophisticated expertise and significant resources that pursues its objectives repeatedly over an extended period and adapts to defenders trying to stop it. The term itself comes from government and military use.
APT cybersecurity is no longer just a national-security concern. The EU agency ENISA analysed 4,875 cyber incidents across the Union between July 2024 and June 2025 and found public institutions the most-targeted sector at 38 percent with state-sponsored espionage on the rise. The groups behind recent headlines, from SolarWinds to Volt Typhoon, go after the kind of infrastructure ordinary businesses depend on.
How an APT Attack Unfolds
An APT is a campaign, not a single event. It runs in stages and the attacker is patient enough to spend weeks or months at each one.
- Reconnaissance: Studying the target, its people and its suppliers.
- Initial access: Getting a first foothold, often through a spear-phishing email, a stolen password or a weakness in an internet-facing device.
- Establishing a foothold: Installing quiet access so the intruder can return at will.
- Escalating privileges: Stealing stronger credentials to reach administrator rights.
- Moving laterally: Hopping from machine to machine towards the data or systems that matter.
- Maintaining persistence: Staying hidden, often for months or years.
- Acting on the objective: Stealing data, preparing disruption or triggering an attack.
What makes these campaigns so hard to catch is a technique called living off the land. Rather than planting obvious malware, the attacker uses the legitimate tools already built into the operating system, so the activity looks like normal administration. US agencies describe this as a hallmark of the Volt Typhoon group.
Entry points vary. Russia’s SVR reached thousands of organisations through a single trusted software update in the SolarWinds case. North Korea’s Lazarus Group has relied on spear-phishing emails. China’s Volt and Salt Typhoon groups have exploited internet-facing edge devices and stolen valid credentials. The first step is rarely loud.
Types of Advanced Persistent Threats
APTs are usually grouped by who runs them and why, rather than by the malware they use. Almost all are backed by a nation-state or act on its behalf, which is what gives them their resources and patience.
- Espionage: Steal government, military or commercial secrets. Russia’s APT29 also known as Cozy Bear, is a long-running example.
- Pre-positioning for sabotage: Quietly gain access to critical infrastructure to be able to disrupt it later. China’s Volt Typhoon has done this in energy, water and telecoms networks.
- Destructive operations: Damage or wipe systems outright, often tied to geopolitical conflict. Russia’s Sandworm group works this way.
- Financially motivated theft: Steal money or cryptocurrency to fund the state. North Korea’s Lazarus Group, whose financial arm is tracked as APT38, is the clearest case.
One source of confusion is naming. The same group picks up different labels from different researchers, so APT29, Cozy Bear and The Dukes all refer to the same Russian operation. A code name like Volt Typhoon and a number like APT29 both simply identify a tracked group.
The Business Impact of an APT
The damage from an APT rarely stops at the data that was stolen. Because these intruders sit inside a network for a long time and often target shared infrastructure, the business impact comes through several mechanisms.
- Loss of sensitive data: Espionage campaigns exfiltrate intellectual property, customer records and strategic plans, often without the victim knowing for months.
- Operational disruption: Destructive attacks can halt production and logistics. NotPetya caused more than 10 billion US dollars in damage worldwide in 2017.
- Collateral damage: You do not have to be the target to be hit. Most NotPetya victims including the shipping company Maersk, were caught in an attack aimed at Ukraine.
- Direct theft: Financially driven groups move real money. North Korea’s Lazarus Group took about 81 million US dollars from Bangladesh Bank.
- Regulatory and legal exposure: A breach that exposes personal data or disrupts an essential service now triggers duties under NIS2, DORA and GDPR with fines and board accountability attached.
Advanced Persistent Threats in the Real World
The clearest way to understand APTs is to look at four campaigns that governments have publicly attributed.
SolarWinds and the Trusted Update
In December 2020 investigators discovered that attackers had slipped a backdoor, known as SUNBURST, into a routine software update for SolarWinds Orion, a tool many organisations use to monitor their networks. About 18,000 customers installed the tainted update although the attackers actively exploited only a smaller subset.
US government departments including the Treasury, Commerce and Energy were among those affected, and the compromise of the build process reached back to around October 2019. On 15 April 2021 the US and UK formally blamed Russia’s foreign intelligence service, the SVR, tracked as APT29 or Cozy Bear.
The entry point was a trusted vendor, because a signed update was enough to get inside. Watching what that software actually did on the network and vetting the supplier behind it mattered more than the signature itself.
Volt Typhoon and Critical Infrastructure
On 7 February 2024 CISA, the NSA and the FBI, with partner agencies, warned that a Chinese state-sponsored group they call Volt Typhoon had burrowed into US critical infrastructure including communications, energy and water networks.
The group was not stealing secrets. The agencies assessed with high confidence that it was pre-positioning, quietly holding access so it could disrupt these services during a future crisis or conflict. In some victim networks it had stayed hidden for at least five years.
Volt Typhoon relied on living off the land, using built-in system tools so there was no malware to flag. That is why antivirus alone would not have found it. Catching this kind of intruder takes detailed logging, behavioural detection and active threat hunting.
NotPetya and Collateral Damage
On 27 June 2017 a wiper called NotPetya spread out of Ukraine and around the world in hours. It was disguised as ransomware but the goal was destruction rather than a ransom. Russia’s military intelligence, the GRU, was behind it. In October 2020 the US indicted six of its officers.
NotPetya entered through a compromised update to Ukrainian accounting software, then spread across networks using an exploit called EternalBlue and stolen credentials. The White House later estimated the damage at more than 10 billion US dollars, hitting organisations in more than 100 countries.
Most of those organisations, including the shipping giant Maersk and the drugmaker Merck, were never the intended target. A patch for EternalBlue had been available for about three months. Prompt patching, network segmentation and offline backups were what limited the damage for the organisations that had them.
The Bangladesh Bank Heist
In February 2016 North Korea’s Lazarus Group pulled off one of the boldest digital thefts on record. Having lurked inside Bangladesh Bank’s network for roughly a year, the attackers used its own SWIFT payment credentials to request about 951 million US dollars from the bank’s account at the Federal Reserve Bank of New York.
Most of the 35 transfer requests were blocked but about 81 million US dollars reached accounts in the Philippines and most of it was never recovered. The US Justice Department later charged North Korean operatives over the scheme.
This was patience turned to profit. A year of quiet access let the group learn the bank’s payment routine. Separating the payment system from the rest of the network and demanding out-of-band approval for large transfers would have broken the plan.
These are not isolated relics. In late 2024 the FBI and CISA disclosed that another Chinese group, Salt Typhoon, had breached major US telecom carriers and reached the systems used for court-ordered wiretaps, a campaign a later advisory said had touched organisations in more than 80 countries.
Advanced Persistent Threats and Compliance
For organisations in Sweden and the EU, defending against APTs is now partly a legal duty. Three regimes matter most.
NIS2 and Cybersäkerhetslagen: The EU’s NIS2 Directive is transposed into Swedish law as Cybersäkerhetslagen (SFS 2025:1506), in force on 15 January 2026. Its Article 21 security measures read like an APT defence checklist, covering continuous monitoring, incident handling, supply-chain security and security awareness training. Article 20 makes the management body responsible and personally accountable.
After a significant incident, an organisation must send an early warning to MCF (formerly MSB) within 24 hours, a full notification within 72 hours and a final report within one month. Fines reach 10 million euro or 2 percent of global turnover for essential entities. Our NIS2 compliance page covers the requirements in full.
DORA: For banks, insurers and other financial entities, the Digital Operational Resilience Act sets ICT incident-management rules under Article 17, supervised in Sweden by Finansinspektionen. Its threat-led penetration testing is designed to test resilience against exactly the kind of advanced attacker that hit Bangladesh Bank. See our DORA compliance page for the detail.
GDPR: Because espionage campaigns often steal personal data, an APT breach can also trigger GDPR Article 33, which requires notifying the Swedish authority IMY within 72 hours. One intrusion can therefore create several reporting duties at once.
How to Spot an Advanced Persistent Threat
You will rarely catch an APT from a single alarm. Because these intruders use valid logins and legitimate tools, the signs are subtle and show up as patterns over time.
- Logins at odd hours or from unusual locations, especially for privileged accounts.
- Dormant or service accounts that suddenly become active.
- Unusual internal traffic as an intruder moves between machines.
- Large amounts of data being gathered, compressed or sent to unfamiliar destinations.
- Administrative tools being used in ways or at times that do not fit normal work.
The honest caveat is that detection alone is unreliable. A determined APT is built to blend in and to erase its traces, so spotting one depends less on any single product and more on collecting detailed logs, understanding what normal looks like and having people actively hunt for what does not fit.
How to Defend Against an Advanced Persistent Threat
No control makes an organisation APT-proof but a layered approach makes a long, quiet intrusion far harder. Work across people, process and technology and start from the assumption that an attacker may already be inside.
- Enforce phishing-resistant multi-factor authentication and give each account only the access it needs.
- Segment the network so a single foothold cannot reach everything.
- Patch internet-facing systems quickly, since edge devices and known flaws are common entry points.
- Centralise logging and monitor continuously, so slow, quiet activity becomes visible.
- Vet your suppliers and the software updates you choose to trust.
- Keep offline, tested backups so you can recover from a destructive attack.
- Write and rehearse an incident response plan before you need it.
- Train staff to recognise spear phishing, the most common first step.
Most of these controls are also what NIS2 now expects so the work of meeting the regulation and the work of stopping an APT are largely the same. For many organisations the practical step is partnering with a team that can monitor around the clock and respond when something is found.
