3 ms·

The "persistent" in APT refers to the threat actor, not the tools themselves. So this is an APT because the threat actor has shown persistence by e.g. using mul

The "persistent" in APT refers to the threat actor, not the tools themselves. So this is an APT because the threat actor has shown persistence by e.g. using multiple SWCs over a period of time and evolving their techniques. The individual tools used by the threat actor may not persist and in fact often don't, as APTs are much more likely to cover their tracks since they have a longer-term vision.

nerdy 10y ago
Not to mention they can reinfect via download and the malware scans the system[1] for: - putty.exe - filezilla.exe - winscp.exe - mstsc.exe - mRemoteNG.exe The malware also has the capabilities to fetch new instructions, so there's no telling what happens when any particular software is detected. [1] https://securelist.com/blog/research/76147/on-the-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users https://securelist.com/blog/research/76147/on-the-strongpity... (linked in the first line of this thread's article)