Advanced persistent threat
noun · also APT · NIST CSRC Glossary
A well-resourced, often state-backed group that targets specific organizations and works to stay hidden in their networks for months or years.
The three words describe what sets these groups apart. Advanced: they have the skill and budget to develop custom tools and sometimes zero-day exploits. Persistent: they pursue a chosen target over long periods, return after being removed, and prioritize staying undetected. Threat: they are organized, motivated and directed, typically toward espionage, intellectual property theft or preparing for disruption.
Security vendors track these groups and give them names, which is why the same actor may be called APT29, Cozy Bear or Midnight Blizzard depending on who is reporting. MITRE ATT&CK maintains a list of groups with the techniques each one has been observed using.
Example
An APT group compromises a contractor that provides IT services to a government ministry, uses the contractor's legitimate remote access to enter the ministry's network, and quietly collects diplomatic email for over a year, using living-off-the-land techniques and only a few custom tools to avoid detection.
Why it matters for a SOC analyst
Most incidents you handle will be criminal rather than state-sponsored, and attributing an attack to an APT is rarely the SOC's job. What matters is understanding their tradecraft: patient, low-noise activity that may not trigger a single high-severity alert. That is why threat hunting and intelligence about the groups that target your sector are worth the effort.
Related terms
- Threat intelligence
Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.
- Tactics, techniques and procedures
How an attacker operates: the goal of each step (tactic), the method used to reach it (technique) and the specific way it is carried out (procedure).
- MITRE ATT&CK
A free, public knowledge base of adversary tactics and techniques based on real-world observations, used as a common language for attack and defense.
- Zero-day
A vulnerability that attackers exploit before the vendor has released a fix, so defenders have had zero days to patch it.