APTAdvanced Persistent Threat
Definition
Threat actor with significant resources, long-term objectives, and sophisticated techniques. Often state-sponsored or backed by high-tier organised crime.
Why they get named (APT28 = Fancy Bear / Russian GRU, APT41 = Chinese, Lazarus = North Korean, Webworm = Chinese): because their infrastructure, TTPs (Tactics, Techniques and Procedures), custom malware, and targets stay consistent over time. That lets CTI (Cyber Threat Intelligence) track them and attribute new incidents.
Typical objectives: espionage, IP exfiltration, sabotage, influence ops. Timelines: months- or years-long campaigns, not hours.
Useful frameworks: MITRE ATT&CK (TTP catalogue), Diamond Model (adversary-capability-infrastructure-victim), Pyramid of Pain (hashes are easy to change, TTPs are hardest).