Advanced persistent threat

From HandWiki
Short description: Set of stealthy and continuous computer hacking processes

An advanced persistent threat (APT) is a stealthy threat actor, typically a state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period.[1][2] In recent times, the term may also refer to non-state-sponsored groups conducting large-scale targeted intrusions for specific goals.[3]

Such threat actors' motivations are typically political or economic.[4] Every major business sector has recorded instances of cyberattacks by advanced actors with specific goals, whether to steal, spy, or disrupt. These targeted sectors include government, defense, financial services, legal services, industrial, telecoms, consumer goods and many more.[5][6][7] Some groups utilize traditional espionage vectors, including social engineering, human intelligence and infiltration to gain access to a physical location to enable network attacks. The purpose of these attacks is to install custom malware (malicious software).[8]

APT attacks on mobile devices have also become a legitimate concern, since attackers are able to penetrate into cloud and mobile infrastructure to eavesdrop, steal, and tamper with data.[9]

The median "dwell-time", the time an APT attack goes undetected, differs widely between regions. FireEye reported the mean dwell-time for 2018 in the Americas as 71 days, EMEA as 177 days, and APAC as 204 days.[5] Such a long dwell-time allows attackers a significant amount of time to go through the attack cycle, propagate, and achieve their objective.

Definition

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:

  • Advanced – Operators behind the threat have a full spectrum of intelligence-gathering techniques at their disposal. These may include commercial and open source computer intrusion technologies and techniques, but may also extend to include the intelligence apparatus of a state. While individual components of the attack may not be considered particularly "advanced" (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools, and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from "less advanced" threats.[3][10][11]
  • Persistent – Operators have specific objectives, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.[10][12]
  • Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code. The operators have a specific objective and are skilled, motivated, organized and well funded. Actors are not limited to state sponsored groups.[3][10]

History and targets

Warnings against targeted, socially-engineered emails dropping trojans to exfiltrate sensitive information were published by UK and US CERT organisations in 2005. This method was used throughout the early 1990s and does not in itself constitute an APT. The term "advanced persistent threat" has been cited as originating from the United States Air Force in 2006[13] with Colonel Greg Rattray cited as the individual who coined the term.[14]

The Stuxnet computer worm, which targeted the computer hardware of Iran's nuclear program, is one example of an APT attack. In this case, the Iranian government might consider the Stuxnet creators to be an advanced persistent threat.[citation needed][15]

Within the computer security community, and increasingly within the media, the term is almost always used in reference to a long-term pattern of sophisticated computer network exploitation aimed at governments, companies, and political activists, and by extension, also to ascribe the A, P and T attributes to the groups behind these attacks.[16] Advanced persistent threat (APT) as a term may be shifting focus to computer-based hacking due to the rising number of occurrences. PC World reported an 81 percent increase from 2010 to 2011 of particularly advanced targeted computer attacks.[17]

Actors in many countries have used cyberspace as a means to gather intelligence on individuals and groups of individuals of interest.[18][19][20] The United States Cyber Command is tasked with coordinating the US military's offensive and defensive cyber operations.[21]

Numerous sources have alleged that some APT groups are affiliated with, or are agents of, governments of sovereign states.[22][23][24] Businesses holding a large quantity of personally identifiable information are at high risk of being targeted by advanced persistent threats, including:[25]

A Bell Canada study provided deep research into the anatomy of APTs and uncovered widespread presence in Canadian government and critical infrastructure. Attribution was established to Chinese and Russian actors.[28]

Life cycle

A diagram depicting the life cycle staged approach of an advanced persistent threat (APT), which repeats itself once complete.

Actors behind advanced persistent threats create a growing and changing risk to organizations' financial assets, intellectual property, and reputation[29] by following a continuous process or kill chain:

  1. Target specific organizations for a singular objective
  2. Attempt to gain a foothold in the environment (common tactics include spear phishing emails)
  3. Use the compromised systems as access into the target network
  4. Deploy additional tools that help fulfill the attack objective
  5. Cover tracks to maintain access for future initiatives

The global landscape of APT's from all sources is sometimes referred to in the singular as "the" APT, as are references to the actor behind a specific incident or series of incidents, but the definition of APT includes both actor and method.[30]

In 2013, Mandiant presented results of their research on alleged Chinese attacks using APT method between 2004 and 2013[31] that followed similar lifecycle:

  • Initial compromise – performed by use of social engineering and spear phishing, over email, using zero-day viruses. Another popular infection method was planting malware on a website that the victim's employees will be likely to visit.[32]
  • Establish foothold – plant remote administration software in victim's network, create net backdoors and tunnels allowing stealth access to its infrastructure.
  • Escalate privileges – use exploits and password cracking to acquire administrator privileges over victim's computer and possibly expand it to Windows domain administrator accounts.
  • Internal reconnaissance – collect information on surrounding infrastructure, trust relationships, Windows domain structure.
  • Move laterally – expand control to other workstations, servers and infrastructure elements and perform data harvesting on them.
  • Maintain presence – ensure continued control over access channels and credentials acquired in previous steps.
  • Complete mission – exfiltrate stolen data from victim's network.

In incidents analysed by Mandiant, the average period over which the attackers controlled the victim's network was one year, with longest – almost five years.[31] The infiltrations were allegedly performed by Shanghai-based Unit 61398 of People's Liberation Army. Chinese officials have denied any involvement in these attacks.[33]

Previous reports from Secdev had previously discovered and implicated Chinese actors.[34]

Mitigation strategies

There are tens of millions of malware variations,[35] which makes it extremely challenging to protect organizations from APT. While APT activities are stealthy and hard to detect, the command and control network traffic associated with APT can be detected at the network layer level with sophisticated methods. Deep log analyses and log correlation from various sources is of limited usefulness in detecting APT activities. It is challenging to separate noises from legitimate traffic. Traditional security technology and methods have been ineffective in detecting or mitigating APTs.[36] Active cyber defense has yielded greater efficacy in detecting and prosecuting APTs (find, fix, finish) when applying cyber threat intelligence to hunt and adversary pursuit activities.[37][38] Human-Introduced Cyber Vulnerabilities (HICV) are a weak cyber link that are neither well understood nor mitigated, constituting a significant attack vector.[39]

APT groups

China

Since Xi Jinping became General Secretary of the Chinese Communist Party in 2012, the Ministry of State Security gained more responsibility over cyberespionage vis-à-vis the People's Liberation Army, and currently oversees various APT groups.[40] According to security researcher Timo Steffens, "the APT landscape in China is run in a 'whole country' approach, leveraging skills from universities, individual, and private and public sectors".[41]

Iran

North Korea

  • Kimsuky
  • Lazarus Group (also known as APT38)
  • Ricochet Chollima (also known as APT37)

Russia

Turkey

  • StrongPity (also known as APT-C-41 or PROMETHIUM)[68]

United States

Uzbekistan

  • SandCat, associated with the State Security Service according to Kaspersky[70]

Vietnam

  • OceanLotus (also known as APT32)[71][72]

Naming

Multiple organizations may assign different names to the same actor. As separate researchers could each have their own varying assessments of an APT group, companies such as CrowdStrike, Kaspersky, Mandiant, and Microsoft, among others, have their own internal naming schemes.[73] Names between different organizations may refer to overlapping but ultimately different groups, based on various data gathered.

CrowdStrike assigns animals by nation-state or other category, such as "Kitten" for Iran and "Spider" for groups focused on cybercrime.[74] Other companies have named groups based on this system — Rampant Kitten, for instance, was named by Check Point rather than CrowdStrike.[75]

Dragos bases its names for APT groups on minerals.[73]

Mandiant assigns numbered acronyms in three categories, APT, FIN, and UNC, resulting in APT names like FIN7. Other companies using a similar system include Proofpoint (TA) and IBM (ITG and Hive).[73]

Microsoft used to assign names from the periodic table, often stylized in all-caps (e.g. POTASSIUM); in April 2023, Microsoft changed its naming schema to use weather-based names (e.g. Volt Typhoon).[76]

See also


Notes

  1. ↑ active since 2013, unlike most APTs, Gamaredon broadly targets all users all over the globe (in addition to also focusing on certain victims, especially Ukraine organizations[65]) and appears to provide services for other APTs.[66] For example, the InvisiMole threat group has attacked select systems that Gamaredon had earlier compromised and fingerprinted.[65]

References

  1. ↑ "What Is an Advanced Persistent Threat (APT)?". https://www.kaspersky.com/resource-center/definitions/advanced-persistent-threats. 
  2. ↑ "What Is an Advanced Persistent Threat (APT)?" (in en). https://www.cisco.com/c/en/us/products/security/advanced-persistent-threat.html. 
  3. ↑ 3.0 3.1 3.2 Maloney, Sarah. "What is an Advanced Persistent Threat (APT)?" (in en). https://www.cybereason.com/blog/advanced-persistent-threat-apt. 
  4. ↑ Cole., Eric (2013). Advanced Persistent Threat: Understanding the Danger and How to Protect Your Organization. Syngress. OCLC 939843912. 
  5. ↑ 5.0 5.1 "M-Trends Cyber Security Trends" (in en). https://www.fireeye.com/current-threats/annual-threat-report/mtrends.html. 
  6. ↑ "Cyber Threats to the Financial Services and Insurance Industries". https://www.fireeye.com/content/dam/fireeye-www/solutions/pdfs/ib-finance.pdf. 
  7. ↑ "Cyber Threats to the Retail and Consumer Goods Industry". https://www.fireeye.com/content/dam/fireeye-www/global/en/solutions/pdfs/ib-retail-consumer.pdf. 
  8. ↑ "Advanced Persistent Threats: A Symantec Perspective". https://www.symantec.com/content/en/us/enterprise/white_papers/b-advanced_persistent_threats_WP_21215957.en-us.pdf. 
  9. ↑ Au, Man Ho (2018). "Privacy-preserving personal data operation on mobile cloud—Chances and challenges over advanced persistent threat". Future Generation Computer Systems 79: 337–349. doi:10.1016/j.future.2017.06.021. 
  10. ↑ 10.0 10.1 10.2 "Advanced Persistent Threats (APTs)". https://www.itgovernance.co.uk/advanced-persistent-threats-apt. 
  11. ↑ "Advanced persistent Threat Awareness". https://www.trendmicro.co.uk/media/misc/apt-survey-report-en.pdf. 
  12. ↑ "Explained: Advanced Persistent Threat (APT)" (in en-US). 2016-07-26. https://blog.malwarebytes.com/101/2016/07/explained-advanced-persistent-threat-apt/. 
  13. ↑ "Assessing Outbound Traffic to Uncover Advanced Persistent Threat". SANS Technology Institute. https://www.sans.edu/student-files/projects/JWP-Binde-McRee-OConnor.pdf. 
  14. ↑ "Introducing Forrester's Cyber Threat Intelligence Research". Forrester Research. http://blogs.forrester.com/rick_holland/13-02-14-introducing_forresters_cyber_threat_intelligence_research. 
  15. ↑ Beim, Jared (2018). "Enforcing a Prohibition on International Espionage". Chicago Journal of International Law 18: 647–672. ProQuest 2012381493. https://www.proquest.com/docview/2012381493. 
  16. ↑ "Advanced Persistent Threats: Learn the ABCs of APTs - Part A". https://www.secureworks.com/blog/advanced-persistent-threats-apt-a. 
  17. ↑ Olavsrud, Thor (April 30, 2012). "Targeted Attacks Increased, Became More Diverse in 2011". CIO Magazine. https://www.cio.com/article/2396583/targeted-attacks-increased--became-more-diverse-in-2011.html. 
  18. ↑ "An Evolving Crisis". BusinessWeek. April 10, 2008. http://www.businessweek.com/magazine/content/08_16/b4080032220668.htm. 
  19. ↑ "The New E-spionage Threat". BusinessWeek. April 10, 2008. http://www.businessweek.com/magazine/content/08_16/b4080032218430.htm. 
  20. ↑ Rosenbach, Marcel; Schulz, Thomas; Wagner, Wieland (2010-01-19). "Google Under Attack: The High Cost of Doing Business in China". Der Spiegel. https://www.spiegel.de/international/world/google-under-attack-the-high-cost-of-doing-business-in-china-a-672742.html. 
  21. ↑ "Commander Discusses a Decade of DOD Cyber Power" (in en-US). https://www.defense.gov/Explore/News/Article/Article/2193130/commander-discusses-a-decade-of-dod-cyber-power/. 
  22. ↑ "Under Cyberthreat: Defense Contractors". Bloomberg.com (BusinessWeek). July 6, 2009. https://www.bloomberg.com/news/articles/2009-07-06/under-cyberthreat-defense-contractorsbusinessweek-business-news-stock-market-and-financial-advice. 
  23. ↑ "Understanding the Advanced Persistent Threat". Tom Parker. February 4, 2010. http://tominfosec.blogspot.com/2010/02/understanding-apt.html. 
  24. ↑ "Advanced Persistent Threat (or Informationized Force Operations)". Usenix, Michael K. Daly. November 4, 2009. https://www.usenix.org/legacy/event/lisa09/tech/slides/daly.pdf. 
  25. ↑ "Anatomy of an Advanced Persistent Threat (APT)". Dell SecureWorks. https://www.secureworks.com/resources/sb-advanced-threat-protection-with-dell-secureworks. 
  26. ↑ Gonzalez, Joaquin Jay III; Kemp, Roger L. (2019-01-16). Cybersecurity: Current Writings on Threats and Protection. McFarland. p. 69. ISBN 978-1-4766-7440-7. https://books.google.com/books?id=FyuFDwAAQBAJ&pg=PA69. 
  27. ↑ Ingerman, Bret; Yang, Catherine (May 31, 2011). "Top-Ten IT Issues, 2011". Educause Review. https://er.educause.edu/articles/2011/5/topten-it-issues-2011. 
  28. ↑ McMahon, Dave; Rohozinski, Rafal. "The Dark Space Project: Defence R&D Canada – Centre for Security Science Contractor Report DRDC CSS CR 2013-007". http://publications.gc.ca/collections/collection_2016/rddc-drdc/D68-3-007-2013-eng.pdf. 
  29. ↑ "Outmaneuvering Advanced and Evasive Malware Threats". Secureworks Insights. https://www.secureworks.com/resources/wp-outmaneuvering-advanced-and-evasive-malware-threats. 
  30. ↑ EMAGCOMSECURITY (9 April 2015). "APT (Advanced Persistent Threat) Group". https://emagcomsecurity.wordpress.com/2015/04/09/apt-advanced-persistent-threat-group//. 
  31. ↑ 31.0 31.1 "APT1: Exposing One of China's Cyber Espionage Units". Mandiant. 2013. http://intelreport.mandiant.com/. 
  32. ↑ "What are MITRE ATT&CK initial access techniques" (in en). 2021-06-08. https://blog.gitguardian.com/inital-access-techniques/. 
  33. ↑ Blanchard, Ben (2013-02-19). "China says U.S. hacking accusations lack technical proof". Reuters. https://www.reuters.com/article/us-china-hacking-idUSBRE91I06120130220. 
  34. ↑ "Tracking GhostNet: investigating a cyber espionage network". The Munk Centre for International Studies, University of Toronto. 28 March 2009. https://ora.ox.ac.uk/objects/uuid:6d1260fd-b8ee-4a11-8a5f-e7708d543651. 
  35. ↑ RicMessier (2013-10-30) (in en). GSEC GIAC Security Essentials Certification All. McGraw Hill Professional, 2013. p. xxv. ISBN 978-0-07-182091-2. https://books.google.com/books?id=zUdZAQAAQBAJ&pg=PR25. 
  36. ↑ "Anatomy of an APT (Advanced Persistent Threat) Attack" (in en). https://www.fireeye.com/current-threats/anatomy-of-a-cyber-attack.html. 
  37. ↑ "Threat Intelligence in an Active Cyber Defense (Part 1)" (in en-US). 2015-02-18. https://www.recordedfuture.com/active-cyber-defense-part-1/. 
  38. ↑ "Threat Intelligence in an Active Cyber Defense (Part 2)" (in en-US). 2015-02-24. https://www.recordedfuture.com/active-cyber-defense-part-2/. 
  39. ↑ "A Context-Centred Research Approach to Phishing and Operational Technology in Industrial Control Systems | Journal of Information Warfare". https://www.jinfowar.com/journal/volume-18-issue-4/context-centred-research-approach-phishing-operational-technology-industrial-control-systems. 
  40. ↑ Mozur, Paul; Buckley, Chris (2021-08-26). "Spies for Hire: China's New Breed of Hackers Blends Espionage and Entrepreneurship" (in en-US). The New York Times. ISSN 0362-4331. https://www.nytimes.com/2021/08/26/technology/china-hackers.html. 
  41. ↑ Stone, Jeff (October 5, 2020). "Foreign spies use front companies to disguise their hacking, borrowing an old camouflage tactic". Cyberscoop. https://www.cyberscoop.com/chinese-iranian-hackers-front-companies/. 
  42. ↑ "Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak". Symantec. 2019-05-07. https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit. 
  43. ↑ "Double Dragon APT41, a dual espionage and cyber crime operation". FireEye. 2019-10-16. https://content.fireeye.com/apt-41/rpt-apt41/. 
  44. ↑ "Bureau names ransomware culprits". Taipei Times. May 17, 2020. https://www.taipeitimes.com/News/taiwan/archives/2020/05/17/2003736564. 
  45. ↑ Tartare, Mathieu; Smolár, Martin (21 May 2020). "No "Game over" for the Winnti Group". We Live Security. https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/. 
  46. ↑ Greenberg, Andy (August 6, 2020). "Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry". Wired. https://www.wired.com/story/chinese-hackers-taiwan-semiconductor-industry-skeleton-key/. Retrieved 7 August 2020. 
  47. ↑ Naraine, Ryan (2021-03-02). "Microsoft: Multiple Exchange Server Zero-Days Under Attack by Chinese Hacking Group" (in English). Wired Business Media. https://www.securityweek.com/microsoft-4-exchange-server-zero-days-under-attack-chinese-apt-group. 
  48. ↑ Burt, Tom (2021-03-02). "New nation-state cyberattacks" (in English). Microsoft. https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/. 
  49. ↑ Nichols, Shaun (2021-10-20). "'LightBasin' hackers spent 5 years hiding on telco networks". https://www.techtarget.com/searchsecurity/news/252508413/LightBasin-hackers-spent-5-years-hiding-on-telco-networks. 
  50. ↑ Ilascu, Ionut (2021-10-19). "LightBasin hacking group breaches 13 global telecoms in two years". https://www.bleepingcomputer.com/news/security/lightbasin-hacking-group-breaches-13-global-telecoms-in-two-years/. 
  51. ↑ Lyngaas, Sean (10 August 2021). "Chinese hackers posed as Iranians to breach Israeli targets, FireEye says". https://www.cyberscoop.com/china-israel-iran-fireeye-hacking/. 
  52. ↑ "APT17: Hiding in Plain Sight - FireEye and Microsoft Expose Obfuscation Tactic". FireEye. May 2015. https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf. 
  53. ↑ Sabin, Sam (October 26, 2022). "New pro-China disinformation campaign targets 2022 elections: Report". Axios. https://www.axios.com/2022/10/26/disinformation-campaign-midterms-china-dragonbridge-mandiant. 
  54. ↑ Chen, Joey (12 May 2020). "Tropic Trooper's Back: USBferry Attack Targets Air-gapped Environments". Trend Micro. https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-troopers-back-usbferry-attack-targets-air-gapped-environments/. 
  55. ↑ Cimpanu, Catalin. "Hackers target the air-gapped networks of the Taiwanese and Philippine military". https://www.zdnet.com/article/hackers-target-the-air-gapped-networks-of-the-taiwanese-and-philippine-military/. 
  56. ↑ Intelligence, Microsoft Threat (2023-05-24). "Volt Typhoon targets US critical infrastructure with living-off-the-land techniques" (in en-US). https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/. 
  57. ↑ van Dantzig, Maarten; Schamper, Erik (2019-12-19). "Wocao APT20". fox-it.com. NCC Group. https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf. 
  58. ↑ Vijayan, Jai (December 19, 2019). "China-Based Cyber Espionage Group Targeting Orgs in 10 Countries". Dark Reading. https://www.darkreading.com/attacks-breaches/china-based-cyber-espionage-group-targeting-orgs-in-10-countries/d/d-id/1336676. 
  59. ↑ Lyngaas, Sean (February 12, 2019). "Right country, wrong group? Researchers say it wasn't APT10 that hacked Norwegian software firm". Cyberscoop. https://www.cyberscoop.com/apt10-apt31-recorded-future-rapid7-china/. 
  60. ↑ Lyngaas, Sean (October 16, 2020). "Google offers details on Chinese hacking group that targeted Biden campaign". https://www.cyberscoop.com/biden-chinese-hacking-google-security-russia/. 
  61. ↑ "Pioneer Kitten APT Sells Corporate Network Access". September 2020. https://threatpost.com/pioneer-kitten-apt-sells-corporate-network-access/158833/. 
  62. ↑ "APT39, ITG07, Chafer, Remix Kitten, Group G0087 | MITRE ATT&CK®". https://attack.mitre.org/groups/G0087/. 
  63. ↑ "Crowdstrike Global Threat Report 2020". 2020. https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf. 
  64. ↑ Kyle Alspach (4 February 2022). "Microsoft discloses new details on Russian hacker group Gamaredon". VentureBeat. https://venturebeat.com/2022/02/04/microsoft-discloses-new-details-on-russian-hacker-group-gamaredon/. 
  65. ↑ 65.0 65.1 Charlie Osborne (21 March 2022). "Ukraine warns of InvisiMole attacks tied to state-sponsored Russian hackers". https://www.zdnet.com/article/ukraine-warns-of-invisimole-attacks-tied-to-state-sponsored-russian-hackers/. 
  66. ↑ "Gamaredon - When nation states don't pay all the bills". Cisco. 23 February 2021. https://blog.talosintelligence.com/2021/02/gamaredonactivities.html. 
  67. ↑ "Adversary: Venomous Bear - Threat Actor" (in en-US). https://adversary.crowdstrike.com/en-US/adversary/venomous-bear/. 
  68. ↑ "PROMETHIUM extends global reach with StrongPity3 APT". Cisco. 29 June 2020. https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html. 
  69. ↑ "Equation: The Death Star of Malware Galaxy". Kaspersky Lab. 2015-02-16. https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/. 
  70. ↑ Gallagher, Sean (3 October 2019). "Kaspersky finds Uzbekistan hacking op… because group used Kaspersky AV". Ars Technica. https://arstechnica.com/information-technology/2019/10/kaspersky-finds-uzbekistan-hacking-opbecause-they-used-kaspersky-av/. 
  71. ↑ Panda, Ankit. "Offensive Cyber Capabilities and Public Health Intelligence: Vietnam, APT32, and COVID-19". The Diplomat. https://thediplomat.com/2020/04/offensive-cyber-capabilities-and-public-health-intelligence-vietnam-apt32-and-covid-19/. 
  72. ↑ Tanriverdi, Hakan; Zierer, Max; Wetter, Ann-Kathrin; Biermann, Kai; Nguyen, Thi Do (October 8, 2020). "Lined up in the sights of Vietnamese hackers". Bayerischer Rundfunk. https://web.br.de/interaktiv/ocean-lotus/en/. "In Bui's case the traces lead to a group presumably acting on behalf of the Vietnamese state. Experts have many names for this group: APT 32 and Ocean Lotus are best known. In conversations with a dozen of information security specialists, they all agreed that this is a Vietnamese group spying, in particular, on its own compatriots." 
  73. ↑ 73.0 73.1 73.2 "Threat Group Naming Schemes In Cyber Threat Intelligence". Curated Intelligence. https://www.curatedintel.org/2022/05/threat-group-naming-schemes-in-cyber.html. 
  74. ↑ "CrowdStrike 2023 Global Threat Report". CrowdStrike. https://iitd.com.ua/wp-content/uploads/2023/03/crowdstrike2023globalthreatreport.pdf. 
  75. ↑ "Rampant Kitten". Thailand Electronic Transactions Development Agency. https://apt.etda.or.th/cgi-bin/showcard.cgi?g=Rampant%20Kitten. 
  76. ↑ Lambert, John (April 18, 2023). "Microsoft shifts to a new threat actor naming taxonomy". Microsoft. https://www.microsoft.com/en-us/security/blog/2023/04/18/microsoft-shifts-to-a-new-threat-actor-naming-taxonomy/. 

Further reading

Lists of APT groups
This article is part of a series on
Information security
Related security categories
Threats
Defenses



Retrieved from "https://handwiki.org/wiki/index.php?title=Advanced_persistent_threat&oldid=3369582"