Strategically-motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack

Advanced persistent threat (APT) is widely acknowledged to be the most sophisticated and potent class of security threat. APT refers to knowledgeable human attackers that are organized, highly sophisticated and motivated to achieve their objectives against a targeted organization(s) over a prolonged period. Strategically-motivated APTs or S-APTs are distinct in that they draw their objectives from the broader strategic agenda of third parties such as criminal syndicates, nation-states, and rival corporations. In this paper we review the use of the term “advanced persistent threat,” and present a formal definition. We then draw on military science, the science of organized conflict, for a theoretical basis to develop a rigorous and holistic model of the stages of an APT operation which we subsequently use to explain how S-APTs execute their strategically motivated operations using tactics, techniques and procedures. Finally, we present a general disinformation model, derived from situation awareness theory, and explain how disinformation can be used to attack the situation awareness and decision making of not only S-APT operators, but also the entities that back them.

• Publication year

  2019

• Venue

  Computers & security

• Publication date

  2019-09-01

• Fields of study

  Computer Science, Political Science

• Identifiers
  DOI 10.1016/J.COSE.2019.07.001arXiv 2103.15005
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Demystifying Deception Technology: A Survey

  2018cited by this paper
• Survey of publicly available reports on advanced persistent threat actors

  2018influential reference
• Enhancing Cohesion and Coherence of Fake Text to Improve Believability for Deceiving Cyber Attackers

  2018cited by this paper
• The eagle has landed – what happens next?

  2016influential reference
• Asset Identification in Information Security Risk Assessment: A Business Practice Approach

  2016cited by this paper
• Advanced persistent threats: Behind the scenes

  2016cited by this paper
• A resiliency framework for an enterprise cloud

  2016influential reference
• Department of Defense Dictionary of Military and Associated Terms

  2016cited by this paper
• Intrusion Detection in 802.11 Networks: Empirical Evaluation of Threats and a Public Dataset

  2016cited by this paper
• J OURNAL OF I NFORMATION T ECHNOLOGY T HEORY AND A PPLICATION

  2016cited by this paper
• The study of APT attack stage model

  2016influential reference
• Cyber Security Deception

  2016cited by this paper
• Anatomy of an advanced persistent threat

  2015influential reference
• Profiling and classifying the behavior of malicious codes

  2015cited by this paper
• Deterring Malicious Behavior in Cyberspace

  2015influential reference
• Non-intrusive Techniques for Vulnerability Assessment of Services in Distributed Systems

  2015cited by this paper
• Trusted Security Policies for Tackling Advanced Persistent Threat via Spear Phishing in BYOD Environment

  2015cited by this paper
• Advanced social engineering attacks

  2015cited by this paper
• The eagle has landed: part one

  2015influential reference
• The Role of Malware in Reported Cyber Espionage: A Review of the Impact and Mechanism

  2015influential reference
• Combating advanced persistent threats: From network event correlation to incident detection

  2015cited by this paper
• Modern IP theft and the insider threat

  2015cited by this paper
• Detection of malicious PDF files and directions for enhancements: A state-of-the art survey

  2015influential reference
• Moving to analysis-led cyber-security

  2014influential reference
• MLDS: Multi-Layer Defense System for Preventing Advanced Persistent Threats

  2014cited by this paper
• A Study on Advanced Persistent Threats

  2014cited by this paper
• Teaching information security management: reflections and experiences

  2014cited by this paper
• Changing the game: The art of deceiving sophisticated attackers

  2014cited by this paper
• Hacking on an industrial scale

  2014influential reference
• Computer science: Hacking into the cyberworld

  2014cited by this paper
• Advanced persistent threats: minimising the damage

  2014influential reference
• Protecting organizational competitive advantage: A knowledge leakage perspective

  2014cited by this paper
• A situation awareness model for information security risk management

  2014cited by this paper
• The gaping hole in our security defences

  2014influential reference
• New rules for combating new threats

  2014influential reference
• Secure Model against APT in m-Connected SCADA Network

  2014influential reference
• Life's certainties: death, taxes and APTs

  2013cited by this paper
• Spear-phishing: how to spot and mitigate the menace

  2013influential reference
• Understanding and overcoming cyber security anti-patterns

  2013influential reference
• Targeted Cyberattacks: A Superset of Advanced Persistent Threats

  2013influential reference
• A breach too far

  2013cited by this paper
• The state of information security

  2012cited by this paper
• Cyber-threat evolution: the past year

  2012cited by this paper
• Deconstructing Flame: the limitations of traditional defences

  2012cited by this paper
• Risks of Advanced Persistent Threats and Defense Against Them

  2011influential reference
• Incorporating a knowledge perspective into security risk assessments

  2011cited by this paper
• Commentary: Cloud computing - A security problem or solution?

  2011cited by this paper
• Managing Information Security Risk: Organization, Mission, and Information System View | NIST

  2011cited by this paper
• Advanced Persistent threats and how to monitor and deter them

  2011influential reference
• The cyber threat, trophy information and the fortress mentality.

  2011cited by this paper
• APTs: a poorly understood challenge

  2011cited by this paper
• Behavioral analysis of botnets for threat intelligence

  2011cited by this paper
• Internet Engineering Task Force (IETF) Request for Comments: 5909

  2010cited by this paper
• Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains

  2010influential reference
• Shadows in the cloud: Chinese involvement in advanced persistent threats

  2010influential reference
• Theory of Activity and Situation Awareness

  1999cited by this paper
• The Farewell Dossier

  1996cited by this paper
• Situation Awareness Is Adaptive, Externally Directed Consciousness

  1995cited by this paper
• Toward a Theory of Situation Awareness in Dynamic Systems

  1995influential reference
• Social research methods : qualitative and quantitative approaches

  1994cited by this paper
• Strategies of Decision Making

  1989cited by this paper
• COMMAND IN WAR

  1985cited by this paper

• SHAPE: An APT Detection Framework Fusing Semantic Understanding and Heterogeneous Modeling

  2026cites this paper
• Managing intellectual property leakage in the digital era: An integrated process model

  2026cites this paper
• Threat Intelligence Driven IP Protection for Entrepreneurial SMEs

  2026cites this paper
• Toward a Dynamic Intellectual Property Protection Model in High-Growth SMEs

  2026influential citation
• Real-Time Detection of Multi-Stage Attacks Using Kill Chain State Machines

  2025cites this paper
• Cyber Security Challenges and Solutions in Critical Infrastructure: A Systematic Review of Threat Spectrum, Systemic Vulnerabilities, and Multi-Level Protection Strategies

  2025cites this paper
• GAN-Driven Feature Selection and GraphSAGE for Advanced Persistent Threat Defense in Smart Grids

  2025cites this paper
• From Concealment to Exposure: Understanding the Lifecycle and Infrastructure of APT Domains

  2025cites this paper
• EarlyCrow: Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries

  2025cites this paper
• Detection and Analysis of Command and Control (C2) Connections in Cybersecurity with C2Sentinel

  2025cites this paper
• Multicriteria Classification Method to Evaluate the Security of Information Systems for Emerging Enterprises

  2025cites this paper
• Is Zero Trust a Solution to Advanced Persistent Threat?

  2025cites this paper
• Enhancing cybersecurity: a semantic network analysis of MITRE ATT&CK® techniques

  2025cites this paper
• Autonomous Identity-Based Threat Segmentation for Zero Trust Architecture

  2025cites this paper
• North Korean Threat Perceptions in Advanced Persistent Threat (APT) Operations in Global Cyberspace

  2025cites this paper
• Explainable AI for Enhancing IDS Against Advanced Persistent Kill Chain

  2025cites this paper
• State responsibility in the context of cyberwarfare: dilemma identification and path reconstruction

  2025cites this paper
• Identifying Abnormal Hosts in Data Streams Using Reversible Sketch

  2025cites this paper
• A comprehensive survey of automated Advanced Persistent Threat attribution: Taxonomy, methods, challenges and open research problems

  2025cites this paper
• Profiling antivaccination channels in Telegram: early efforts in detecting misinformation

  2025cites this paper
• Threat model for IEC 61850 based substation automation system

  2025cites this paper
• Cyberbezpieczeństwo systemu finansowego

  2025cites this paper
• Politicking influence operations at the intersection of information disorders and supply chain performance

  2025cites this paper
• GReAT-BeD: Graph Rewriting for Activity Tracking and (Malicious) Behaviour Detection

  2025cites this paper
• MECHANISM FOR MANAGING ACCESS TO INFORMATION RESOURCES AT AN ENTERPRISE

  2025cites this paper
• Integrating Behavioral Science and Cyber Threat Intelligence (CTI) to Counter Advanced Persistent Threats (APTs) and Reduce Human-Enabled Security Breaches

  2025cites this paper
• Platforms, Politics, and the Crisis of Democracy: Connective Action and the Rise of Illiberalism

  2025cites this paper
• APT-LLM: Embedding-Based Anomaly Detection of Cyber Advanced Persistent Threats Using Large Language Models

  2025cites this paper
• Autonomous Identity-Based Threat Segmentation in Zero Trust Architectures

  2025cites this paper
• Deep Learning in Wazuh Intrusion Detection System to Identify Advanced Persistent Threat (APT) Attacks

  2025cites this paper
• Spatio-Temporal Advanced Persistent Threat Detection and Correlation for Cyber-Physical Power Systems Using Enhanced GC-LSTM

  2025cites this paper
• Assessing the psychometric properties of the intrinsic motivation inventory in blended learning environments

  2024cites this paper
• Advanced Persistent Threat Kill Chain for Cyber-Physical Power Systems

  2024cites this paper
• A Survey on Advanced Persistent Threat Detection: A Unified Framework, Challenges, and Countermeasures

  2024cites this paper
• Moving Beyond Traditional Incident Response: Combating APTs with Warfare-Enabled Continuous Response

  2024cites this paper
• Social automation and APT attributions in national cybersecurity

  2024cites this paper
• The whole of cyber defense: Syncing practice and theory

  2024cites this paper
• Explainable deep learning approach for advanced persistent threats (APTs) detection in cybersecurity: a review

  2024cites this paper
• A Comprehensive Survey of Advanced Persistent Threat Attribution: Taxonomy, Methods, Challenges and Open Research Problems

  2024cites this paper
• Disjointed Cyber Warfare: Internal Conflicts among Russian Intelligence Agencies

  2024cites this paper
• Modeling and study of defense outsourcing against advanced persistent threat through impulsive differential game approach

  2024cites this paper
• Framework for Mitigating Phishing E-mail in the Kenyan Banking Industry Using Artificial Intelligence (AI)

  2024cites this paper
• Information Security Culture: The Effect of Strategy, Technology, Organization, People and the Environment

  2024cites this paper
• AdamW+: Machine Learning Framework to Detect Domain Generation Algorithms for Malware

  2024cites this paper
• Browser‐in‐the‐middle attacks: A comprehensive analysis and countermeasures

  2024cites this paper
• Kohti parempaa viranomaisten disinformaatiotilannetietoisuutta

  2024cites this paper
• Detecting and Understanding Self-Deleting JavaScript Code

  2024cites this paper
• Lateral movement detection through a heteregenous GNN model of kernel-level log

  2024cites this paper
• Advanced persistent threats and the “big four”: State-sponsored hackers in China, Iran, Russia, and North Korea in 2003–2021

  2024cites this paper
• Fuzzy inference based feature selection and optimized deep learning for Advanced Persistent Threat attack detection

  2023cites this paper
• Forensics for multi-stage cyber incidents: Survey and future directions

  2023cites this paper
• PALANTIR: An NFV-Based Security-as-a-Service Approach for Automating Threat Mitigation

  2023cites this paper
• Modelling language for cyber security incident handling for critical infrastructures

  2023cites this paper
• Cross-domain network attack detection enabled by heterogeneous transfer learning

  2023cites this paper
• Recent Developments in Game-Theory Approaches for the Detection and Defense against Advanced Persistent Threats (APTs): A Systematic Review

  2023cites this paper
• Walking under the ladder logic: PLC-VBS: a PLC control logic vulnerability scanning tool

  2023cites this paper
• Minimizing incident response time in real-world scenarios using quantum computing

  2023cites this paper
• A System Dynamics Approach to Evaluate Advanced Persistent Threat Vectors

  2023cites this paper
• Cyber-threat intelligence for security decision-making: A review and research agenda for practice

  2023cites this paper
• Persistent MobileApp-in-the-Middle (MAitM) attack

  2023cites this paper
• Are crowd-sourced CTI datasets ready for supporting anti-cybercrime intelligence?

  2023cites this paper
• A Systematic Literature Review and a Conceptual Framework Proposition for Advanced Persistent Threats (APT) Detection for Mobile Devices Using Artificial Intelligence Techniques

  2023cites this paper
• Russian Anti-Western Disinformation, Media Consumption and Public Opinion in Georgia

  2023cites this paper
• Modern Progressive Pitfalls of Cyber Attacks on the Digital World

  2023cites this paper
• Investigating the advanced persistent threat (APT) network traffics using a statistical analysis approach

  2023cites this paper
• XFedHunter: An Explainable Federated Learning Framework for Advanced Persistent Threat Detection in SDN

  2023cites this paper
• IT ARMY OF UKRAINE AS COMPLEX ADAPTIVE SYSTEM

  2023cites this paper
• Fingerprinting generation for Advanced Persistent Threats (APT) detection using Machine Learning techniques

  2023cites this paper
• Cyber Threats Classifications and Countermeasures in Banking and Financial Sector

  2023cites this paper
• Comparative Analysis of Deep Learning and Machine Learning models for Network Intrusion Detection

  2023cites this paper
• Cybersecurity Measures Using Machine Learning for Business Applications

  2023cites this paper
• Evaluation of Local Security Event Management System vs. Standard Antivirus Software

  2022cites this paper
• Walking Under the Ladder Logic: PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool

  2022cites this paper
• Understanding situation awareness in SOCs, a systematic literature review

  2022cites this paper
• Detection and Isolation Malware by Dynamic Routing Moving Target Defense with Proxies

  2022cites this paper
• The Effect of Big Data Analytics in Enhancing Agility in Cybersecurity Incident Response

  2022cites this paper
• Malicious Code Classification Method of Advanced Persistent Threat Based on Asm2Vec

  2022cites this paper
• APTKG: Constructing Threat Intelligence Knowledge Graph from Open-Source APT Reports Based on Deep Learning

  2022cites this paper
• The COVID‐19 scamdemic: A survey of phishing attacks and their countermeasures during COVID‐19

  2022influential citation
• Detecting fake news and disinformation using artificial intelligence and machine learning to avoid supply chain disruptions

  2022cites this paper
• Factors Influencing the Organizational Decision to Outsource IT Security: A Review and Research Agenda

  2022cites this paper
• Advanced Persistent Threat intelligent profiling technique: A survey

  2022cites this paper
• APT beaconing detection: A systematic review

  2022cites this paper
• Exploration of Mobile Device Behavior for Mitigating Advanced Persistent Threats (APT): A Systematic Literature Review and Conceptual Framework

  2022influential citation
• Snakes and Ladder Logic: PLC-VBS, a PLC Control Logic Vulnerability Discovery Tool

  2022cites this paper
• A False Sense of Security — Organizations Need a Paradigm Shift on Protecting Themselves against APTs

  2022cites this paper
• Adopting and integrating cyber-threat intelligence in a commercial organisation

  2022cites this paper
• Cyber Kill Chain, MITRE ATT&CK, and the Diamond Model: a comparison of cyber intrusion analysis models

  2022cites this paper
• Identifying Key Relationships between Nation-State Cyberattacks and Geopolitical and Economic Factors: A Model

  2022cites this paper
• Actionable Intelligence-Oriented Cyber Threat Modeling Framework

  2022cites this paper
• Threat intelligence ATT&CK extraction based on the attention transformer hierarchical recurrent neural network

  2022cites this paper
• APT attacks on industrial control systems: A tale of three incidents

  2022cites this paper
• Exploring the vulnerability in the inference phase of advanced persistent threats

  2022cites this paper
• Enhancing Strategic Information Security Management in Organizations through Information Warfare Practices

  2021cites this paper
• Teaching Information Security Management Using an Incident of Intellectual Property Leakage

  2021cites this paper
• Case-based learning in the management practice of information security: an innovative pedagogical instrument

  2021cites this paper
• Advanced malware propagation on random complex networks

  2021cites this paper
• Cyber-resilience of Critical Cyber Infrastructures: integrating digital twins in the electric power ecosystem.

  2021cites this paper
• Dynamic Information Security Management Capability: Strategising for Organisational Performance

  2021cites this paper
• The Dark Web Phenomenon: A Review and Research Agenda

  2021cites this paper