Strategically-Motivated Advanced Persistent Threat: Definition, Process, Tactics and a Disinformation Model of Counterattack

• APT38 reportedly stole more than a hundred million dollars across 11 countries while maintaining access to targeted financial organizations for an average of 155 days.Reported access lasted up to two years; the team gathered intelligence and then deleted logs or deployed disk-wiping malware.Source: §1.0 · p. 1
• APTs are organized, technologically expert attacks that pursue objectives against targets over prolonged periods.The paper describes APTs as well-funded and capable of using a range of technologies.Source: §1.0 · p. 2
• The paper adopts an organized-conflict perspective to place APT tactics within operations and provide a holistic view of the threat.An operation is described as a sequence of tactical actions with a common purpose or unifying theme.Source: §1.0 · p. 2
• The paper’s socio-organizational approach supports management strategy beyond a purely technology-centric view of technical measures and countermeasures.Source: §1.0 · p. 2
• The paper moves from reviewing APT terminology to defining S-APTs, modeling operations and tactics, and proposing disinformation to undermine operators and their backers.Source: §1.0 · p. 2

• Military science offers a lens for treating APTs as organized activities that pursue objectives beyond immediate effects on data and systems.The paper characterizes such operations as organized entities applying resources deliberately to attack or defend assets.Source: §2.0 · p. 2
• APT analysis distinguishes strategic end states, operational plans, and the tactical steps used to carry them out.An operation is a sequence of tactical actions with a common purpose or unifying theme (JP 1-0 2013, I-9).Source: §2.0 · pp. 2–3
• Tactical goals can build toward broader strategic objectives, and reverse-engineering an attacker’s operation can help defenders anticipate movements and disrupt or manipulate it.The paper gives the example of multiple intellectual-property thefts contributing to a backing power’s goal of market dominance.Source: §2.0 · p. 3
• Situation awareness develops through perception, comprehension, and projection of a situation’s elements, relationships, and implications.Endsley’s model is selected because its linear process lends itself to specifying a counterprocess intended to deny situation awareness.Source: §2.0 · p. 3
• Situation awareness is needed to coordinate tactical actions with operational goals and strategic objectives across levels of command.Source: §2.0 · p. 3
• Situation awareness supports decisions and actions, and deliberately supplied disinformation can induce a false but seemingly credible mental representation of reality.The paper links changes in available evidence to changes in situation awareness.Source: §2.0 · p. 3

• The authors searched EBSCO literature databases for “advanced persistent threat,” first to trace public usage and then across English-language peer-reviewed publications.Source: §3.0 · pp. 3–4
• After screening, the review retained 42 substantial treatments of APTs, including 16 process descriptions.The initial search found 110 results; manual relevance checks narrowed these to 38 sources, and a further journal search added four relevant articles.Source: §3.0 · p. 4
• The authors iteratively matched literature-described tactics to JP 3-12’s six operational functions to develop APTOL and organize the tactics review.They repurposed situation-awareness theory to frame disinformation measures, and included some non-peer-reviewed sources for specific TTP details.Source: §3.0 · p. 4
• The literature review was exploratory, intended to identify a knowledge gap and an opportunity to contribute to theory and practice.Source: §3.0 · p. 4

• Early public usage included a 2007 patent application published in 2008, while mainstream media initially used APT specifically for state-sponsored actors.Source: §4.0 · p. 4
• Some early accounts characterized APTs as well-resourced, highly targeted attacks by country-sponsored groups seeking intellectual property and competitive advantage (Walsh, 2008, 13).Source: §4.0 · p. 4
• By the end of 2010, information-security literature used APT beyond state-sponsored operations, including long-term campaigns by well-resourced adversaries against specific targets using sophisticated TTPs.The implications of APTs being conducted for powerful entities with something to gain had not been thoroughly explored.Source: §4.0 · p. 4
• APT discussion often centered on technology-focused tactics, with differing efforts to connect them into a definite process or lifecycle.Source: §4.0 · p. 5
• Existing process descriptions lacked a theoretical basis and comprehensive account, and several focused on information gathering rather than sabotage missions.The paper notes sabotage examples including Stuxnet, Shamoon 2, and Crash Override.Source: §4.0 · p. 5
• The security industry and researchers commonly describe APTs as penetrating networks, establishing persistent access, and collecting information, though some accounts also include disruption or sabotage.Source: §4.0 · p. 5
• Prior peer-reviewed process descriptions did not capture the human dimensions of awareness and decision-making involved in APTs.Source: §4.0 · p. 5

5.0 A formal APT definition

• The literature uses APT more broadly than its original meaning, while converging on malicious, organized, highly sophisticated campaigns targeting specific organizations for long-term access.The shared characteristics also include obtaining information or sabotaging operations.Source: §5.0 · p. 5
• An APT is an entity conducting malicious, organized, highly sophisticated long-term or reiterated network intrusion and exploitation to obtain information, sabotage a target organization’s operations, or both.Source: §5.0 · p. 6
• The definition’s two core functions are obtaining information and sabotage, and an operation may pursue either or both.Source: §5.0 · p. 6

6.0 An Operational Framework for Interpreting the Objectives of Strategically-motivated Advanced Persistent Threat

• Unlike O-APTs, S-APTs draw strategic objectives from an external party and integrate their TTPs to serve that party’s purposes.Source: §6.0 · p. 7
• S-APTs conduct sophisticated, long-term or reiterated intrusion and exploitation to obtain information, sabotage operations, or both, in support of another entity’s broader agenda to gain or maintain wealth or power.Source: §6.0 · p. 7
• Understanding an S-APT’s strategic objectives can help defenders anticipate tactical movement, allocate resources, disrupt operations, and mislead backing decision-makers through the operator.Source: §6.0 · pp. 7–8
• APTOL links tactical milestones to strategic objectives, helping interpret goals, assess operational maturity, disrupt operations, and target operators or their chains of command with information attacks.Source: §6.0 · p. 8
• The framework comprises eight milestones, from target selection, vulnerability assessment, and penetration through infiltration, sustainability, mobility, reconnaissance, and action on data targets.The milestones are interdependent; target choice reflects expected value relative to strategic objectives, and maneuver may precede, coincide with, or follow vulnerability assessment.Source: §6.0 · pp. 8–9, Figure 2 · p. 8
• Operators need situation awareness for task execution and operational security, while preprogrammed sabotage may complete milestones outside the target system with no human involvement after deployment.In those cases, situation awareness is relevant during malware development to meet design requirements for operational security and task execution.Source: §6.0 · p. 8

Target Selection

• S-APTs target organizations for valuable information or strategic roles, pursuing financial gain, competitive advantage, information theft, or sabotage for criminal, corporate, or state backers.Target intelligence may come from public sources and be collected well before an attack; some organizations are targeted as entry points to others.Source: §7.0 · pp. 9–10

Assessing System Vulnerability

• After selecting a target, operators assess technical weaknesses and human fallibility, then tailor direct exploits, social engineering, custom malware, and attack preparation to the organization.Assessment can be intrusive or non-intrusive; preparation may include rehearsing against reconstructed defenses and researching individuals or organizations to impersonate.Source: §7.0 · p. 10

Maneuvering (fires)

• Operators gain entry through direct, indirect, or blended exploits, commonly using spear phishing, infected sites, attachments, removable media, or compromised software and devices.Indirect approaches can bypass perimeter defenses; spear-phishing attachments can covertly activate malware that performs further functions during the mission.Source: §7.0 · pp. 10–11

Infiltration

• After access, operators map and fingerprint networks to plan further actions, while using inconspicuous behavior, ordinary protocols, and low-density signaling to stay undetected.They may conceal or erase logs, attack defenses, or create diversions; conspicuous missing data may itself reveal an intrusion.Source: §7.0 · pp. 11–12
• S-APT toolkits can be built out or adapted during a mission, using malware reconfiguration, rootkits, encryption, packers, and code obfuscation to preserve functionality and evade detection.Operators may also leave malware dormant or use legitimate system components instead; detecting such activity depends on correlating network behavior and combining technical analysis with specialized human analysts.Source: §7.0 · p. 12

Assuring Sustainability

• Sustaining an operation requires command-and-control infrastructure and durable network access, supported by remote-access channels, persistent implants, multiple backdoors, and stolen credentials.Credential theft can enable privilege escalation or malware-free access, while redundant accounts and backdoors reduce the risk that discovery of one access route ends the operation.Source: §7.0 · pp. 13–14
• A configuration mistake in Triton/Trisis triggered a safety shutdown and forensic investigation that uncovered the malware, ending an operation that might otherwise have persisted for years.The malware’s validation failure between redundant processing units caused the shutdown; investigators found a disguised executable and an archive containing Triton/Trisis.Source: §7.0 · p. 14

Assuring Mobility

• S-APT operators maintain access to the network nodes needed for their operation, with network architecture and segmentation shaping their mobility.Connected safety and operations systems can allow attackers to manipulate both without additional mobility measures.Source: §7.0 · p. 14

Focused Intelligence Surveillance and Reconnaissance

• A persistent presence supports focused surveillance of organizational activity, systems, and people likely to access or possess target data.Operators collect both information needed to conduct the mission and information tied to operational or strategic objectives; learning normal network activity helps them avoid anomalous behavior.Source: §7.0 · p. 14

Action on Data Targets

• Once target data is located, operators can capture or copy it, or sabotage it by manipulating, removing, or introducing data.Malware may collect specified data automatically, while sabotage can be subtle or cause physical equipment destruction through reprogramming.Source: §7.0 · p. 15
• S-APTs commonly exfiltrate data in small, inconspicuous amounts, sometimes timing transfers for high-traffic periods to reduce notice.Data may be compressed or disguised, staged on a host, and routed through compromised systems; chains of connections can obscure the destination and mislead attribution.Source: §7.0 · p. 15
• S-APTs commonly remove forensic evidence to deny defenders insight into their presence and agenda, and may plant misleading evidence to misdirect attribution.Malware can erase evidence or self-delete automatically or on operator command.Source: §7.0 · p. 15

Scope and boundaries

• Passive disinformation can target operators in monitored environments, but broader offensive action against operators or backing entities raises legal boundaries for civilian organizations.The paper describes civilian network attacks as generally criminal unless conducted with the owners’ express consent, such as for security testing.Source: §8.0 · p. 16

Situation awareness and disinformation

• Disinformation accepted as legitimate can cause misperception, misapprehension, and misprediction, leading to decisions and actions that may culminate in mission failure.The proposed sequence runs from false information through distorted understanding and projection to action or inaction whose effects diverge from expectations.Source: §8.0 · p. 16

Operational deception

• A honey network can make mission-task awareness spurious while monitoring reveals operator maneuvers and may inform countermeasures.Those lessons can help defeat the current operation and render the maneuvers obsolete in future operations.Source: §8.0 · p. 17, Figure 3 · p. 17

Strategic disinformation

• The FAREWELL example describes CIA- and FBI-engineered disinformation that fed flawed products and designs to KGB Line X, with altered software linked to the destruction of a gas pipeline.The paper presents the pipeline destruction as one of the program’s most spectacular impacts.Source: §8.0 · p. 17
• A company could plant false product specifications for an S-APT operator to pass to backing-entity analysts, targeting their understanding of the competitive environment.The genuine specifications are kept offline in the example.Source: §8.0 · p. 17
• Strategic misperceptions may contribute to mission failures such as ineffective resource plans, defective goods, or investments in equipment that becomes chronically problematic.The examples include false impressions of supply-chain dependence, misleading product specifications, and failure built into equipment routines.Source: §8.0 · p. 18

Limits and risks

• Deception is not guaranteed: an unconvincing product may be rejected, while convincing disinformation can prompt an unintended response.The passage gives the example of false specifications inspiring a better R&D program and market dominance.Source: §8.0 · p. 18

Designing disinformation

• Disinformation must be carefully designed with subject-matter experts; fooling a backing entity may require expertise beyond information security.The example of fake product specifications may require input from R&D and business or finance experts, depending on the intended effects.Source: §8.0 · p. 18

Contributions

• The paper defines APT, develops the APT operation line model (APTOL) from military doctrine, organizes S-APT literature with it, and considers situation-awareness counterattacks against operators and backers.APTOL highlights operation vulnerabilities and interdependencies among tactical milestones.Source: §9.0 · p. 18

Novelty and future research

• The authors identify strategic disinformation using S-APTs as vectors, and information-security professionals’ role in it, as an area not previously examined to their knowledge.They call for multidisciplinary research into APTs’ roles in strategies of nations, businesses, and criminal syndicates.Source: §9.0 · p. 18

Implications

• The authors consider point-in-time advantage from disinformation realistic, while shaping backing entities’ long-term strategic agendas may not be.They note that routine disinformation could raise the time and resource costs of verifying acquired or sabotage-related data.Source: §9.0 · p. 18

Limitations

• The review’s peer-reviewed-source emphasis, APTOL’s human-awareness assumptions, and reliance on one situation-awareness theory limit the study’s scope.Automation or AI may alter operations, and another awareness model may better explain disinformation in these contexts.Source: §9.0 · p. 19

10.0 Conclusion

• The organized-conflict perspective frames S-APTs as operations serving strategic objectives beyond an operation’s apparent purpose.This framing is presented as supporting a more holistic understanding of strategically motivated APTs.Source: §10.0 · p. 19
• The paper illustrates how military-science principles apply to APTs and how situation-awareness theory helps explain requirements for deception.Source: §10.0 · p. 19
• The paper explains how disinformation can deceive or counterattack the backing entities that sponsor and profit from S-APT operations.Source: §10.0 · p. 19