How An APT Attack Is Launched In 5 Steps

 

Introduction

A trend that has dramatically shifted in this COVID19 pandemic is  that the Cyberattacker is now taking their own sweet time to launch their threat vectors.  Gone are the days of the “Smash and Grab” campaigns, where they would take all that they could in one attempt. 

Now, they are carefully studying their targets in smaller numbers and uncovering their weak spots quicker.  Then, once they get in, the goal is to stay in for a long period of time, and take key assets a bit at a time, going unnoticed until it is too late.

A perfect example of this is what is known as the “Advanced Persistent Threat”, or “APT” for short.

Defining What An APT Is

An APT can be technically defined as follows:

“It. . . is a sophisticated, systematic cyber-attacks program that continues for an extended period of time, often orchestrated by a group of skilled hackers. The hacker group, or the APT, designs the attack with a particular motive that can range from sabotage to corporate espionage.”

(SOURCE:  1).

Breaking down this definition further reveals more.  For example, we are not talking about some novice Cyberattacker that are launching these kinds of variants.  These hackers more than likely originate from those nations that are deemed to deemed to be nation state threat actors, with extremely sophisticated skills and abilities. 

Second, the ultimate objective is not just to steal Personal Identifiable Information (PII) datasets, but to go well beyond that.  Rather, they want things of extremely high value, such as Intellectual Property (IP), to even extortion to fetch a large sum of money.

Also, the Cyberattackers that launch these kinds of campaigns are extremely organized in what they do, so that can be in a covert state for a very long period of time. 

The Anatomy Of An APT

In fact, there is a 6-step process which is normally followed, which is as follows:

1)     Gaining the foothold:

Getting access through a very weak spot in the network infrastructure is the primary way in which the Cyberattacker gets in.  But as mentioned, they take an enormous amount of time to find this position.  The reason for this is that they do not want to raise any alarms or triggers that a security breach is underway, only that a short-lived compromise occurred.  This is how they can stay in for so long.

2)     The malware is deployed:

With an APT, the malware that is installed is not really meant to cause any sort of initial damage.  Rather, the intended goal of the payload is to listen to and probe for other avenues in order to get into other areas of the network in a stealthy manner.  This information is then relayed back to the Cyberattacker, so more of them can enter in.

3)     Further points of compromise are installed:

Once the other weak spots have been determined, additional “toeholds” are deployed in order to gain access to what is being sought after.  The primary reason for doing this is that it acts as redundancy for the Cyberattacker, in case one point of compromise gets sealed off, they have others that can be used.

4)     The attack begins:

Now, the Cyberattacker is set to go after the very high value targets.  As also mentioned previously, their goal is to take the smallest chunks as possible, so that it does not garner any attention.  Once this has been accomplished, they can then “reassemble” the asset back into its original form.

5)     The Cyberattacker then leaves:

Just as quietly as they entered in, the same is true as they leave.  They remove all traces of their existence, and because of that, only a short-lived compromise is recorded onto the logs of the network security devices.

At the present time, the traditional lines of defense, such as antivirus/antimalware apps, firewalls, network intrusion devices, routers, cannot detect APT attacks as they happen.

The Warning Signs Of An APT

Although APT attacks are extremely difficult to detect, they do give away some telltale signs.  But the caveat here is that it takes a very well-trained eye to scope out for them.  Here are some of them:

Ø  Typically, most network access activity occurs during the normal business hours.  But in order to avoid detection, the Cyberattacker will attempt to launch their APT attack during the non-peak time, such as during the night.  If there is an increase of activity during this timeframe, then something is definitely going to happen.

Ø  There will be an increased amount of Trojan Horses in your network infrastructure.  While the Cyberattacker will deploy malware that is almost close to impossible to detect, from time to time, Trojan Horses will still be used.

Ø  Unusual flows of data will be apparent.  Keep in mind that the Cyberattacker will take out only the smallest amounts of it as possible at a time.  But the timing in which they are taken out will be rather unusual, once again, probably during non-business hours.

Ø  The data will be aggregated together in very small chunks.  Although it is quite normal for a network infrastructure to bundle this together, the Cyberattacker will not only group them in a way that is very unusual but will even store them at very odd places that you would not even think of until they are ready to exfiltrate them out.

How To Fend Off An APT

In the end, each and every business is prone to APT attack.  But the key is what you can do decrease the statistical odds or mitigate the probabilities of this from happening.  Here are some steps that you can take:

1)     Implement the Zero Trust Framework:

This is a methodology in which you cannot trust anybody or anything, whatsoever.  In order to establish legitimacy of whom they claim to be an employee must go authenticated through least through or more unique mechanism.

2)     Make use of constant monitoring:

Although your employees work in only a certain part of the day, it does not mean that your security devices should also.  They should be on a 24 X 7 X 365 basis, continually keeping an eye on your network infrastructure.  In this regard, you should consider seriously of make use of what is known as a “Security Information and Event Management”, or “SIEM” package.  This will present real time information and data to your IT Security team and filter out for the false positives.

3)     Whitelist only authorized applications:

By doing this, any software application that has been installed without prior approval will be brought to your attention immediately.  Using non authorized apps is one of those backdoors that Cyberattackers very often look for when launching an APT attack.

Sources

1)     https://www.forcepoint.com/cyber-edu/advanced-persistent-threat-apt