An advanced persistent threat (APT) is a skilled, well-resourced attacker, usually backed by a state, that gets into a network and stays there for a long time without being noticed. Advanced describes their skill and tooling. Persistent describes their patience: they come back after being removed, and they will spend months on one target. Threat means there are people with a clear objective behind it, usually espionage, sometimes disruption, and occasionally money.
The term also names the groups themselves. APT28, APT29 and APT41 are labels for specific, long-running operations. This guide covers how APTs differ from other attackers, how they operate, how they're named, and what they look like in a Microsoft environment.
How APTs differ from other attackers
- Objective. A ransomware crew wants to be paid quickly. An APT usually wants information or access that it can use for months or years.
- Visibility. Ransomware announces itself. An APT tries never to be seen, and success for them means you never find out.
- Target selection. Criminals take whoever is easiest. An APT picks its targets, and will work through suppliers, contractors and partners to reach them.
- Resources. State-backed groups can afford custom malware, zero-days and long campaigns, and they don't need any one intrusion to pay for itself.
The line is blurring. Some state groups also make money from crime, and criminal groups now use techniques once reserved for APTs. Our guide to zero-day attacks covers one of those shared tools.
How an APT intrusion unfolds
- Reconnaissance. Researching people, suppliers and exposed systems, often for weeks.
- Initial access. Spear phishing, password spraying, an exploited edge device, or a compromised supplier.
- Establishing a foothold. A backdoor, a stolen token, a malicious app registration or a new MFA method on a real account.
- Privilege escalation and lateral movement. Collecting credentials and moving towards the systems that hold what they came for.
- Collection and exfiltration. Quietly, in small amounts, often through cloud services that blend with normal traffic.
- Persistence. Several independent ways back in, so that removing one doesn't remove them.
Living off the land
Many APTs avoid custom malware where they can, and use tools already on the system: PowerShell, WMI, scheduled tasks, remote management tools and built-in clients. In October 2026, researchers described APT28 running a backdoor through a hidden Microsoft Edge window and tunnelling out with the SSH client that ships with Windows. We break it down, with Defender hunting queries, in our threat research post.
How APT groups are named
Every security vendor tracks groups under its own names, so one group can have half a dozen labels. Microsoft uses a weather-based taxonomy, where the family name indicates origin:
- Blizzard: Russia
- Typhoon: China
- Sandstorm: Iran
- Sleet: North Korea
- Storm- followed by a number: a group still being tracked, before it gets a permanent name.
Some groups you'll see in UK advisories:
- APT28 / Forest Blizzard / Fancy Bear: attributed by the UK and US governments to Russia's GRU military intelligence. Known for credential theft, password spraying and targeting governments and defence.
- APT29 / Midnight Blizzard / Cozy Bear: attributed to Russia's SVR foreign intelligence service. In January 2024, Microsoft disclosed that the group had accessed some of its corporate email accounts after password spraying a legacy test tenant.
- Volt Typhoon: a China-linked group that the NCSC and its Five Eyes partners warned in 2023 and 2024 was pre-positioning in critical infrastructure using almost entirely built-in tools.
What an APT looks like in Microsoft 365 and Windows
No single alert says "APT". The signs are small, and they tend to look like normal activity. These are the patterns worth watching:
- Low-and-slow password spraying against many accounts, a few attempts each, from rotating addresses. See our guide to password spraying.
- New MFA methods, app registrations or OAuth consents that nobody can explain.
- Mailbox access through unusual routes: EWS, Graph API or a newly added application reading many mailboxes. Our post on the AA26-281A mailbox theft playbook is a worked example.
- Built-in tools used in odd ways: PowerShell from Office, scheduled tasks created by scripts, SSH from a workstation, a browser started by a batch file.
- Quiet outbound connections to webhook services, new cloud storage or bare IP addresses at regular intervals.
- Edge devices behaving strangely: new admin accounts on firewalls or VPNs, configuration changes nobody made.
How to defend against APTs
- Make initial access expensive. Phishing-resistant MFA for administrators, blocked legacy authentication, macros from the internet blocked, and edge devices patched fast.
- Collect the right logs, and keep them. Entra sign-in and audit logs, the unified audit log, endpoint telemetry and edge device logs, retained long enough to look back months.
- Hunt, don't just alert. APTs are built to stay under alert thresholds. Regular, hypothesis-led hunting finds what rules miss.
- Use threat intelligence. Know which groups target your sector and region, and test your detections against their known techniques.
- Plan for persistence. When you find one way in, assume there are others. Rotate credentials, review app consents and check every account the attacker touched.
Frequently asked questions
Is every nation-state attack an APT?
Not necessarily. Some state-linked activity is short and noisy, such as hacktivist denial-of-service campaigns. "APT" describes the long-term, targeted kind.
Would a mid-sized organisation be targeted by an APT?
Yes, often as a route to someone else. Suppliers, law firms, managed service providers and engineering firms are targeted because of who they work with.
How long do APTs stay undetected?
It varies widely, from days to years. The intrusion that APT28 ran in 2026 was active for at least two months before it was analysed, and the researchers advised treating it as ongoing.
Can antivirus stop an APT?
On its own, rarely. APTs use legitimate tools and valid accounts, which signature-based tools are not designed to flag. Detecting them takes correlation across identity, endpoint, email and cloud, and people who know what to look for.
How Wizard Cyber can help
Our SOCs are staffed 24/7, and we've run Microsoft Sentinel since 2019. On our managed service, every alert goes through CYBERSHIELD AI's multi-stage investigation pipeline, with senior analyst sign-off by default. If you suspect someone is already inside, our compromise assessment looks across your estate for the traces APTs leave behind.
To find out more, talk to us or book a demo.