Written and maintained by CASRAI Editorial Board
Last updated
An advanced persistent threat (APT) is a well-resourced adversary that pursues its objectives repeatedly over an extended period, rather than a single piece of malware or a one-off attack. This guide is for IT, security and research-administration staff who need a precise definition, a way to read APT group names, and a mapping from CISA’s mitigation advice to practical controls.
What is an advanced persistent threat?
CISA describes APT actors as well-resourced and engaged in sophisticated malicious cyber activity that is targeted and aimed at prolonged network or system intrusion. Their objectives include espionage, data theft, and network or system disruption or destruction (CISA, Advanced Persistent Threats, read 2026-11-07).
The three words in the name each carry a meaning. Advanced refers to expertise and resources and the use of several attack vectors. Persistent refers to pursuing objectives repeatedly over time and adapting to defenders. Threat refers to an adversary with intent and capability, not just a vulnerability.
How NIST defines an advanced persistent threat
The NIST Computer Security Resource Center glossary lists several definitions of the term, each taken from a different publication. They emphasise different things, which is useful when a policy or contract cites a specific NIST document (NIST CSRC glossary, read 2026-11-07).
| NIST publication | What the definition emphasises |
|---|---|
| SP 800-30 Rev. 1 and SP 800-39 | An adversary with sophisticated levels of expertise and significant resources, able to use multiple attack vectors (cyber, physical and deception). |
| SP 800-39 | Pursues its objectives repeatedly over an extended period of time, adapts to defenders’ efforts to resist, and is determined to maintain the level of interaction needed to execute its objectives. |
| SP 800-53 Rev. 5 | Establishing and extending footholds within the IT infrastructure of target organisations in order to exfiltrate information, undermine mission, or position itself to do so in the future. |
| SP 800-172 Rev. 3 | An adversary or collection of adversaries that may be collaborating, opportunistically overlapping, or inadvertently converging. |
Read together, the definitions describe an actor defined by capability, persistence and objective, not by a specific tool. For the risk-assessment context in which SP 800-39 and SP 800-30 sit, see the CASRAI guide to NIST SP 800-30 risk assessment.
Which is an example of an advanced persistent threat?
Examples are named groups, not single incidents. MITRE ATT&CK maintains a Groups catalogue of activity clusters tracked under a common name in the security community. Entries include Lazarus Group (G0032), APT28 (G0007), APT29 (G0016), OilRig (G0049), APT41 (G0096), Turla (G0010), Sandworm Team (G0034) and Volt Typhoon (G1017) (MITRE ATT&CK Groups, read 2026-11-07).
MITRE notes that group entries are based on public reporting and are not complete. A group listed there is a tracked activity cluster, so it should not be read as a settled statement of who is behind any particular intrusion.
How APTs are named and tracked
CISA notes that researchers name APTs independently, so a single group can carry several names. MITRE handles this by recording overlaps as “Associated Groups” and states that these are not exact matches. In practice, when a threat report names an APT, check the ATT&CK group ID and its associated-groups list before concluding that two reports describe the same actor.
Why research institutions should care
Because CISA lists espionage and data theft among APT objectives, any organisation that holds valuable data or connects to government, industry or defence partners can be a target. Universities and research organisations commonly hold unpublished results, personal data on participants and controlled information under federal agreements. That is an editorial reading of CISA’s objectives rather than a statistic. Security frameworks attached to funding are covered in the CASRAI guides to FISMA compliance and the CMMC final rule.
Defences CISA recommends
CISA’s APT page lists concrete mitigations. The table maps each one to what it asks of an institutional IT team.
| CISA mitigation | What it means in practice |
|---|---|
| Prioritise known exploited vulnerabilities | Patch first the flaws listed in CISA’s Known Exploited Vulnerabilities (KEV) Catalog. Keeping software updated helps most when updates are ordered by known exploitation. |
| Fix common misconfigurations | Review default and weak configurations on internet-facing and internal systems. |
| Apply least privilege | Limit accounts to the access their role needs, so a compromised account reaches less. |
| Close and monitor high-risk ports | Restrict and watch services such as RDP, SMB and SSH. |
| Logging and baselines | Keep logs and know normal behaviour so unusual activity, such as unexpected slowdowns, can be recognised and investigated. |
| Tabletop exercises | Rehearse the response; see the CASRAI guide to tabletop exercises. |
| Report incidents | Report suspected APT activity to CISA and the FBI. |
Frequently asked questions
What does “persistent” mean in an APT?
It means the adversary pursues its objectives repeatedly over an extended period of time and adapts to defenders’ efforts, per NIST SP 800-39 as quoted in the NIST glossary.
Can one group have more than one APT name?
Yes. CISA states that researchers name APTs independently, and MITRE records overlaps as associated groups rather than exact matches.
Is an APT the same as ransomware or malware?
No. In the NIST and CISA definitions an APT is an adversary defined by resources, persistence and objectives. Such an actor may use malware among other tools, but the term describes the actor, not the tool.
What are the 7 layers of defense in depth?
No NIST definition fixes a number of layers. The NIST glossary defines defense in depth as an information security strategy that integrates people, technology and operations capabilities to establish variable barriers across multiple layers of the organisation (SP 800-53 Rev. 5, SP 800-39 and SP 800-172 Rev. 3, citing CNSSI 4009). Another NIST-cited definition describes applying multiple countermeasures in a layered or stepwise manner so that an attack missed by one control is caught by another (NISTIR 8183, citing ISA/IEC 62443). Seven-layer lists found elsewhere are vendor or teaching models, not a NIST or CISA standard, so name the source when you use one. Read the CISA mitigations above as one layered set of controls against an APT (NIST CSRC glossary, “defense in depth”, read 2026-11-07).
What are the 5 C’s of cybersecurity?
There is no “5 C’s” framework in the NIST or CISA material cited on this page, and the lists that circulate under that name differ between publishers, so this guide does not endorse one. For a standards-based structure, NIST’s Cybersecurity Framework 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Sources
- NIST CSRC Glossary, “advanced persistent threat”: csrc.nist.gov/glossary/term/advanced_persistent_threat (read 2026-11-07; also the “defense in depth” entry at csrc.nist.gov/glossary/term/defense_in_depth).
- CISA, Advanced Persistent Threats: cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats (read 2026-11-07).
- MITRE ATT&CK Groups: attack.mitre.org/groups (read 2026-11-07).
