4 ms·

They refer to the actor as APT, but this sounds like a highly sophisticated attack. That the malware knows it is in a sandbox and shuts down is not simple code

by tmaly 6y ago

They refer to the actor as APT, but this sounds like a highly sophisticated attack. That the malware knows it is in a sandbox and shuts down is not simple code. This does not sound like a script kiddie What type of actor would have the time and resources for this type of attack?

astockwell 6y ago
APT means Advanced Persistent Threat and is usually the term used for nation-state actors.
- tmaly 6y ago
  That is what I was thinking, but I thought the phrase "state actor" was more common. Why use APT in this case?
  - CrazyPyroLinux 6y ago
    overlapping but non-equivalent terms; state actors are often APTs, but not all APTs are state actors (criminal gangs etc)
  - AnimalMuppet 6y ago
    "State actor" is a who. "APT" is more of a "how". It describes adversaries who are very technically sophisticated ("advanced"), and who can remain in your network undetected for a long time ("persistent"). Another aspect of "persistent" is that they can be very hard to eradicate - you have to find all the backdoors that they left on all the machines.
korethr 6y ago
Maybe I am misunderstanding your post, but I get the impression you consider APT == script kiddie. I was of the opposite understanding, that Advanced Persistent Threat != script kiddie. It seems right there in the name, an entity that's been and continues to be around, and has shown from TTP analysis that they have the resources to have nice tools, and the competence to use them well. I suppose you could maybe consider the constant presence of skiddies over time to be a Persistent Threat, but probably not an Advanced one. I have also heard of companies claiming to have been breached by an APT to try to excuse their poor or lack of security process. But my understanding of script kiddies vs APT was that the former does things like buying lists of systems accepting RDP connections from the public internet, and then proceeding to light up the SOC like a Christmas tree when they start deploying crypto miner bots. And that the latter comes in over a supply chain compromise, uses heretofore-not-analyzed malware to compromise monitoring so their traffic data is "accidentally" discarded by the netflow collectors, and then patiently spreads across the enterprise through lateral movement until they find the credit card numbers or diplomatic documents, depending on whether they are a criminal fraud group or state espionage group.

by tmaly 6y ago

astockwell 6y ago

APT means Advanced Persistent Threat and is usually the term used for nation-state actors.

tmaly 6y ago
That is what I was thinking, but I thought the phrase "state actor" was more common. Why use APT in this case?
- CrazyPyroLinux 6y ago
  overlapping but non-equivalent terms; state actors are often APTs, but not all APTs are state actors (criminal gangs etc)
- AnimalMuppet 6y ago
  "State actor" is a who. "APT" is more of a "how". It describes adversaries who are very technically sophisticated ("advanced"), and who can remain in your network undetected for a long time ("persistent"). Another aspect of "persistent" is that they can be very hard to eradicate - you have to find all the backdoors that they left on all the machines.

korethr 6y ago

Maybe I am misunderstanding your post, but I get the impression you consider APT == script kiddie. I was of the opposite understanding, that Advanced Persistent Threat != script kiddie. It seems right there in the name, an entity that's been and continues to be around, and has shown from TTP analysis that they have the resources to have nice tools, and the competence to use them well. I suppose you could maybe consider the constant presence of skiddies over time to be a Persistent Threat, but probably not an Advanced one. I have also heard of companies claiming to have been breached by an APT to try to excuse their poor or lack of security process. But my understanding of script kiddies vs APT was that the former does things like buying lists of systems accepting RDP connections from the public internet, and then proceeding to light up the SOC like a Christmas tree when they start deploying crypto miner bots. And that the latter comes in over a supply chain compromise, uses heretofore-not-analyzed malware to compromise monitoring so their traffic data is "accidentally" discarded by the netflow collectors, and then patiently spreads across the enterprise through lateral movement until they find the credit card numbers or diplomatic documents, depending on whether they are a criminal fraud group or state espionage group.