Cyberespionnage : the APT threat

APT (Advanced Persistent Threat) attacks are computer attacks designed to compromise and maintain access to an entity's information system for the purpose of stealing information and data, usually from a private company or government body. The first of these attacks was publicized at the beginning of this century, but visibility of this type of threat really exploded in 2010 with Operation Aurora, targeting Google in particular.

The modus operandi of these attacks, described in this article, varies little and can be summarized as follows. The attackers first study their target, in order to obtain the elements they need to carry out an initial compromise of the system. Once access has been obtained, they deploy on the system, reinforcing existing access (by adding backdoors or remote control tools) and gaining extended rights on the network. They then target the desired information and exfiltrate it. They generally maintain their access for weeks, months or, in some cases, years.

What makes these attacks difficult to detect and combat is that the adversary maintains access over time by regularly changing the tools deployed on the system. Malware and software useful to the attacker are updated, and the servers controlling this malware also change regularly.

We will nevertheless propose solutions for detecting and maintaining this type of attack on a computer system.