Analysing Recent APT Incidents: Case Studies and Lessons Learned

Advanced Persistent Threats (APTs) are some of the worst threats facing organisations in the modern world. The purpose of this paper is to review the most recent APT cases to define more characteristic Tactics, Techniques, and Procedures (TTPs), and learn from the attacks. We also look at examples to analyse the effect of APTs across a range of industries such as healthcare, finance and government. Some important conclusions are presented as following, APT groups are becoming progressively more complex; They employ innovative approaches which may include zero-day exploits and supply chain attacks; They are able to persist inside a target’s network for months, taking their time before executing further attacks. To avoid such attacks, organisations must adopt multi-layered defence, whereby there is maximum network security, endpoint protection, security training and physical security policies. Consequently, prevention and protection against APTs involve collaboration with other organisations as well as information exchange.