APT Lifecycle: Initial Access to Exfiltration

Advanced Persistent Threat (APT) refers to sophisticated, nation-state or well-funded adversaries who conduct long-duration, targeted campaigns. Unlike opportunistic attackers, APTs invest significant resources in specific high-value targets: defense contractors, financial institutions, government agencies.

Lockheed Martin's Cyber Kill Chain describes APT operations in seven phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control (C2), and Actions on Objectives. Defenders can disrupt the campaign by breaking any link in the chain.

APT actors perform extensive passive OSINT: LinkedIn employee profiles (identifying IT admins), job postings (revealing technology stack), GitHub repositories (leaking internal code), Shodan searches (finding exposed services), and certificate transparency logs (discovering subdomains).

After reconnaissance, APTs craft targeted weaponized documents: Excel macros exploiting a recently disclosed CVE, PDF files with JavaScript, or trojanized software updates. Delivery is typically spear phishing to identified high-value targets, or strategic web compromises (watering holes).

Exploitation uses zero-days or known CVEs against unpatched systems. Installation establishes persistence: scheduled tasks, registry Run keys, service installations, WMI subscriptions, or bootkit implants. APTs favor lightweight first-stage implants that download the full toolkit post-compromise.

APT C2 blends into normal traffic: HTTPS to CDN providers, DNS tunneling, domain fronting, and social media-based C2 (posting to Twitter/GitHub). Long beacon intervals (hours or days) avoid pattern detection. Encrypted communications with certificate pinning defeat SSL inspection.

APTs move laterally using compromised credentials, Pass-the-Hash, Kerberoasting, and living-off-the-land tools. They map the network, identify high-value targets (domain controllers, file servers, data repositories), and establish multiple persistence points for redundancy.

APTs escalate from user to administrator to domain admin. Techniques: local privilege escalation (kernel exploits, service misconfigurations), Kerberoasting service accounts, DCSync to dump NTDS.dit, and Golden/Silver Ticket attacks for persistent, hard-to-detect domain access.

Final phase varies by APT motive: espionage (exfiltrate classified documents, IP, or communications), sabotage (Stuxnet-style destructive attacks), financial theft (SWIFT transaction manipulation), or establishing persistent access for future operations without immediate noisy action.

APTs exfiltrate data slowly to avoid detection: splitting large datasets into small transfers over weeks, using encrypted archives, compressing data before transfer, staging data on compromised intermediate systems, and exfiltrating via legitimate cloud services (OneDrive, Dropbox) to blend with normal traffic.

Defenders can disrupt APTs at every phase: email filtering disrupts delivery, patching disrupts exploitation, EDR disrupts installation, network segmentation limits lateral movement, privileged access workstations protect credentials, and data loss prevention tools detect exfiltration.

In the Cyber Kill Chain, at which phase does an attacker establish persistence on a compromised system?

APT campaigns follow a structured lifecycle from OSINT reconnaissance through weaponization, delivery, exploitation, C2 establishment, lateral movement, privilege escalation, and exfiltration. Understanding each phase enables defenders to break the kill chain before adversaries reach their objectives.