← All lessons
Threats · Intermediate · 4 min
Nation-state hackers (APTs)
Patient, well-funded and usually after secrets, not ransom.
What it is
Advanced Persistent Threats (APTs) are hacking groups backed by governments. They spy, steal intellectual property, pre-position inside critical infrastructure and sometimes sabotage. Security companies give them names (Fancy Bear, Lazarus, Volt Typhoon) and track their tactics. Many 'live off the land', using built-in admin tools so they blend in with normal activity.
Real case · 2020
SolarWinds
Russian intelligence hackers slipped a backdoor into updates for SolarWinds Orion, network software used by about 18,000 organisations, then picked high-value targets including US government agencies.
Source: Wikipedia: 2020 US federal government data breach
How defenders stop it
- Map defences to attacker behaviour using MITRE ATT&CK
- Log and review use of admin tools like PowerShell
- Segment networks so one foothold doesn't reach everything
- Threat hunting: assume breach and look for it
Check yourself
1. What does 'living off the land' mean?
- Hacking from a rural location
- Using a system's own legitimate tools to avoid detection
- Stealing farming data
- Only attacking physical infrastructure
Show answer
Using a system's own legitimate tools to avoid detection. Built-in tools look normal, so defenders watch how they're used, not just whether they run.
2. What does APT stand for?
- Automated Phishing Tool
- Anti-Piracy Team
- Applied Penetration Test
- Advanced Persistent Threat
Show answer
Advanced Persistent Threat. APTs are government-backed groups that spy, steal and pre-position, often staying hidden for a long time.
3. Which framework maps attacker tactics so defenders can check what they'd detect?
- MITRE ATT&CK
- CVSS
- GDPR
- TLS
Show answer
MITRE ATT&CK. MITRE ATT&CK catalogues how attackers behave, so teams can map their defences and find the gaps.
Answer them in the app to earn XP.
Next: DDoS attacks →