Strategically-Motivated Advanced Persistent Threat: Definition, Process, Tactics and a Disinformation Model of Counterattack Atif Ahmad Jeb Webb School of Computing and Information Systems Oceania Cyber Security Centre The University of Melbourne Melbourne, Australia Parkville, Australia
[email protected] [email protected] Kevin C. Desouza James Boorman QUT Business School Oceania Cyber Security Centre Queensland University of Technology Melbourne, Australia Queensland, Australia
[email protected] [email protected] Abstract Advanced persistent threat (APT) is widely acknowledged to be the most sophisticated and potent class of security threat. APT refers to knowledgeable human attackers that are organized, highly sophisticated and motivated to achieve their objectives against a targeted organization(s) over a prolonged period. Strategically-motivated APTs or S-APTs are distinct in that they draw their objectives from the broader strategic agenda of third parties such as criminal syndicates, nation-states, and rival corporations. In this paper we review the use of the term “advanced persistent threat,” and present a formal definition. We then draw on military science, the science of organized conflict, for a theoretical basis to develop a rigorous and holistic model of the stages of an APT operation which we subsequently use to explain how S-APTs execute their strategically motivated operations using tactics, techniques and procedures. Finally, we present a general disinformation model, derived from situation awareness theory, and explain how disinformation can be used to attack the situation awareness and decision making of not only S-APT operators, but also the entities that back them. Keywords: Advanced Persistent Threat; APT; Cybersecurity; Information Security Management; Situation Awareness Theory; Strategic Disinformation 1.0 Introduction • On 3 October 2018, FireEye published an article on what is thought to be a state-sponsored advanced persistent threat (APT) team dubbed “APT38” (Fraser et al 2018).