APT (advanced persistent threat)
advanced persistent threat · intrusion set · state-sponsored attacker · nation-state actor · threat group · menace persistante avancée
A highly organised group of attackers, often linked to a state, that quietly gains long-term access to a targeted network to spy, steal secrets or prepare sabotage.
In practice
“Advanced” refers to their means (custom tools, zero-days, targeted phishing); “persistent” to their determination to stay for months without being noticed. These groups target government, defence, research and energy, but also smaller subcontractors that are easier to breach and lead to their larger customers. ANSSI calls them “intrusion sets”; MITRE ATT&CK documents their techniques to help defenders.
On 29 April 2025, France attributed the APT28 intrusion set to Russian military intelligence (GRU). Since 2021 it had been used to target or compromise around a dozen French organisations, including a sports body linked to the Paris 2024 Games. The same intrusion set was behind the 2015 sabotage of the TV5Monde television network.
How to protect yourself
- Monitor edge devices and centralise logs to spot quiet, long-term intrusions.
- Apply least privilege and give administrator accounts special protection.
- Demand security guarantees from suppliers who can access your network.
- Follow CERT-FR publications and threat intelligence relevant to your sector.
