What Is an APT? The Attackers Who Are Willing to Wait
An advanced persistent threat is a patient, well-funded intrusion built around one thing: staying hidden for as long as it takes.
3 min readIntermediate Sep 7, 2026
Explain Like I'm Not a Hacker
A burglar who moves into the attic and quietly lives there for a year, taking one small thing at a time so nobody ever notices the pattern.
The 30-second explanation
Most attackers grab what they can and leave quickly. An advanced persistent threat does the opposite: it settles in, moves slowly, and holds onto access for months so it can quietly collect whatever it came for, at its own pace.
How it works
- 1
1. Target
A victim is chosen and researched in detail, sometimes over weeks.
- 2
2. Enter
Access comes through targeted phishing or a carefully chosen weakness.
- 3
3. Persist
Several separate ways back in get set up, in case one is found and closed.
- 4
4. Collect
Data of interest is gathered slowly, in small enough pieces to stay quiet.
APT describes a pattern of behaviour rather than any one group: a determined adversary with real resources and a specific objective in mind. Operations like this often start small, with targeted phishing or an exposed, forgotten service, before the attacker sets up several separate ways back in, learns the network at a leisurely pace, and moves carefully toward whatever systems actually hold what they're after. Loud, obvious actions are avoided wherever possible, and built-in administrative tools do most of the work instead of custom malware. None of that is proof of who's behind it. Public attribution to a specific state or organisation needs cited evidence, so this page sticks to the general pattern rather than naming anyone.
Real-world example
A routine logging review turns up a rarely used account signing in at the same quiet hour every week, reaching a file share it's never touched before. Nothing about any single login looks malicious. It's the regularity, and the choice of target, that points to someone who's been there for a long time already.
How to spot it
Regular, quiet beacon traffic
Small, periodic connections going out to servers nobody recognises.
Legitimate tools used oddly
Administration tools run by accounts that have never touched them before.
Persistence turning up in odd places
New scheduled tasks, services or accounts that nobody on the team created.
Interest limited to high-value data
Access narrowly focused on a small set of genuinely sensitive files.
What to do
- 1Assume a determined attacker could already be inside, and hunt for signs of them rather than waiting on alerts alone.
- 2Cut standing access where possible, segment sensitive systems, and require MFA for every administrator.
- 3Keep log retention long, since the earliest sign of access could easily be months old by the time it's found.
Stay curious. Stay safer.
This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.
Keep reading
- Advanced Persistent Threats
Living off the Land: Attacks That Use Your Own Tools Against You
2 min read - Threat Intelligence
MITRE ATT&CK: The Attacker's Playbook, Published for Defenders
4 min read - SOC & Blue Team
Threat Hunting: Looking for Attackers Nobody Has Alerted On
2 min read - Security Basics
MFA: The Second Lock That Hackers Can Still Pick
4 min read