6 Strategies to Combat Advanced Persistent Threats

Understanding APTs

An APT is often a highly sophisticated cyberattack that targets a specific organization or entity, such as a corporation, government agency, or critical infrastructure. With meticulous planning, extensive reconnaissance, and impressive persistence, APTs can gain unauthorized access to the victim's network and remain undetected for an extended period.

APTs are used primarily to engage in information warfare through espionage, intellectual property theft, disruption of critical systems, or illegal revenue generation. State-sponsored attackers, organized crime groups, or even hacktivists carry out such attacks. Increasingly, APTs are exploiting zero-day vulnerabilities while still actively employing social engineering techniques to gain initial access. 

The critical dangers of APTs include:

• Data breaches and exfiltration

• Sabotage and disruption

• Intellectual property theft

• Long-term monitoring

Data breaches and exfiltration

APTs often result in massive data breaches, exposing sensitive information such as personal records, financial data, and classified government documents. In other cases, victims are targeted with data exfiltration and extortion demands. All these scenarios can lead to identity theft, financial loss, reputational damage, and even compromised national security.

Sabotage and disruption

APTs can target critical infrastructure, including healthcare, energy, financial services, transportation, and water supplies. By gaining control or disrupting these systems, attackers can cause widespread chaos and endanger lives.

Intellectual property theft

Corporations and research institutions are particularly vulnerable to APTs that seek to steal valuable intellectual property, trade secrets, or research findings. Such thefts can have significant economic implications by stifling innovation and giving competitors an unfair advantage.

Long-term monitoring

One of the most insidious aspects of APTs is their ability to remain undetected for extended periods, allowing attackers to monitor and gather sensitive information over time. This period is called “dwell time.” The dwell time could include more than 200 days of data extraction, or it could begin a few weeks before the launch of a ransomware attack.

During the dwell time, hackers enjoy a period of clandestine surveillance that ultimately arms them with information. They can then use this information to adapt their strategy and tactics for additional attacks, blackmail, manipulation, and ransom demands.

According to Akamai’s 2023 SOTI report on malicious DNS traffic, between 10% and 16% of organizations have encountered command and control (C2) traffic in their network in any given quarter. The presence of C2 traffic indicates the possibility of an attack in progress or a breach. A total of 26% of affected devices have reached out to known initial access broker (IAB) C2 domains, including Emotet and Qakbot-related domains. IABs present a large risk to organizations as their primary role is to perform the initial breach and sell access to ransomware groups and other cybercriminal groups.

A ransomware attack on critical public infrastructure

Another infamous ransomware attack on an energy pipeline company in May 2021 highlights the impact of criminal groups on critical infrastructure and the economy. The cybercriminal group DarkSide infiltrated the energy pipeline company’s systems, encrypted crucial data, and exfiltrated sensitive information to strengthen their ransom demands. The successful attack caused widespread fuel shortages and led to a nationwide state of emergency.

This incident underscores the dire consequences of APTs on critical infrastructure. It highlights the importance of enhancing cybersecurity defenses to prevent threat actors from crippling essential services, weakening customer trust, and damaging brand reputation and revenue.

Six strategies for defending against APTs and hacktivism

To combat evolving threats, organizations should invest in comprehensive security solutions that help them follow these six strategies:

1. Never trust — always verify. Secure employee access to enterprise resources through a Zero Trust security solution that provides identity-based, next-generation reverse proxy access 

2. Safeguard employee access. Further protect employee access with a multi-factor authentication (MFA) solution that provides phish-proof, FIDO2-level authentication

3. Provide a secure web gateway. Protect employee access to the internet with a secure web gateway (SWG) that shields users and their devices from web-based threats like malicious websites and traffic, viruses, malware, and ransomware

4. Defend infrastructure. Safeguard internet assets, employee-facing assets, and network infrastructure against DDoS attacks

5. Prevent DNS outages. Safeguard DNS to ensure nonstop availability of servers, applications, APIs, and other network resources

6. Shield web applications and APIs. Defend public-facing web applications and APIs against runtime attacks, automated threats, and specialized attacks

Akamai offers integrated and robust security with a suite of best-in-class solutions

Akamai Prolexic 

Akamai Prolexic is a purpose-built DDoS protection platform that is available on-prem, in the cloud, or as a hybrid of both. Prolexic Cloud is powered by advanced automation, machine intelligence, and a global network of several cloud scrubbing centers across 32 global metro areas and more than 20 Tbps of dedicated defense capacity. 

The keyword to note there is “dedicated” — unlike some solutions that piggyback on their content delivery network capacity, thereby offering cybercriminals a single point of defense to overcome. To put Prolexic’s defense capacity in perspective, even the largest known Layer 3 and Layer 4 DDoS attacks don’t make up 10% of the capacity available to Prolexic customers.