Advanced persistent threat (APT)

In February 2013, Mandiant published its APT1 report: a group it tied to Unit 61398 of the People's Liberation Army had breached 141 organizations, stayed inside for 356 days on average, and in one case for four years and ten months. The report took the term out of intelligence circles. An advanced persistent threat refers both to this kind of intrusion and to the actor behind it, a well-resourced group, often linked to a state or working on its behalf. Advanced, because it brings high-end skills and sometimes previously unknown flaws (zero-days). Persistent, because the attacker wants to stay, for months or years, without being seen. It picks its target, adapts its methods patiently and pursues a specific goal: economic or political espionage, theft of intellectual property, groundwork for sabotage. Opportunistic crime, by contrast, hits whoever is exposed. The label also names the group itself, under aliases that vary by vendor: APT28 or Fancy Bear and Sandworm (Russia, GRU), APT29 or Cozy Bear (Russia, SVR), Lazarus (North Korea), APT41 (China). The line blurs when a state group also runs for profit, Lazarus first among them. For insurers, long dwell time inflates the loss, and a state's hand opens the fight over attribution and over war or sovereign-act exclusions. NotPetya, attributed to the Russian military by London and Washington in February 2018, led Zurich to invoke its war exclusion against Mondelez, until a 2022 settlement. Since March 31, 2023, Lloyd's Market Bulletin Y5381 has required Lloyd's cyber policies to exclude state-backed attacks, which makes attribution a contract question as much as an intelligence one. Then there is dating: an intrusion that ran for years can predate the policy's retroactive date.