APT

What is an APT (Advanced Persistent Threat)?

An APT (Advanced Persistent Threat) is a well-organised attacker with extensive expertise and resources, often a state actor, that penetrates a specific organisation and stays undetected for a long time in order to spy or to prepare sabotage. The term refers both to the attack campaign and to the group behind it, such as Sandworm or Volt Typhoon. In OT, an APT targets industrial processes, power grids, water treatment and other critical infrastructure. What separates it from ordinary cybercrime is the goal: an APT does not want quick money, but lasting access and, ultimately, influence over the physical process.

🧠 What makes an attack an APT?

The term was coined in the US Air Force in 2006 and became widely known through Mandiant’s 2013 APT1 report, which linked a Chinese military unit in Shanghai to years of espionage against at least 141 organisations. NIST describes an APT as an adversary with sophisticated expertise and significant resources that uses multiple attack vectors to establish a foothold, adapts to the defender’s efforts and pursues its objectives repeatedly over an extended period.

Dwell time shows how big the difference is. According to Mandiant, the median dwell time across all investigated intrusions in 2024 was eleven days, partly because ransomware announces itself quickly. State actors are a different story: in February 2024, US and allied agencies found that Volt Typhoon had been present in some networks for at least five years.

🎯 Which APT groups attack OT?

APT groups carry a different name at each security vendor. Mandiant numbers them (APT28, APT44), Microsoft uses weather names per country (Typhoon for China, Blizzard for Russia, Sandstorm for Iran) and Dragos uses minerals. In early 2026, Dragos tracked 26 OT threat groups, eleven of which were active in 2025, including three new ones.

The methods differ widely. In the 2015 blackout, BlackEnergy mainly served to get in; the actual outage was caused with stolen VPN credentials and by remotely taking over the operators’ SCADA workstations. In 2016, Industroyer itself spoke the grid protocols IEC 60870-5-104, IEC 60870-5-101, IEC 61850 and OPC DA to operate breakers. TRITON targeted Schneider Electric Triconex safety systems at a Saudi petrochemical plant. Stuxnet infected Windows engineering stations running Siemens Step 7 and replaced code blocks in the PLCs, so that operators kept seeing normal values.

FrostyGoop, which shut down heating to more than 600 apartment buildings in Lviv via Modbus TCP in January 2024, also shows that attackers abuse industrial protocols directly; that attack has not been publicly attributed to a group.

🔓 How does an APT attack on OT unfold?

Lockheed Martin’s Cyber Kill Chain model describes seven steps from reconnaissance to action. For industrial environments, Michael Assante and Robert M. Lee published the ICS Cyber Kill Chain at SANS in 2015, with two stages: first the intrusion into the IT network, then the development and execution of an attack on the control system. In practice it looks like this:

1. Reconnaissance - gathering information about staff, suppliers, networks and the controllers in use.
2. Initial access - through phishing, a vulnerable VPN or firewall, or a supplier (supply chain).
3. Foothold - backdoors, malware or a rogue device; often stolen accounts as well.
4. Lateral movement - gaining admin rights and moving from the office network to engineering workstations, the historian and remote access connections.
5. Preparing the OT attack - studying project files, process graphics and protocols, sometimes for months.
6. Execution - changing control logic, disabling protections or blinding the operators.
7. Persistence - keeping backdoors in place, even after recovery attempts.

MITRE ATT&CK for ICS provides concrete techniques for each step, such as Modify Parameter and Alarm Suppression, which makes it the shared language for detection and threat hunting.

🔐 How do you recognise APT activity in OT?

APTs leave few traces, but in a stable OT network unusual behaviour actually stands out. Watch for these signals in particular:

🏭 How do you defend an OT environment against APTs?

Keeping an APT out entirely rarely succeeds. The aim is to spot the attacker as early as possible and to make sure a compromised office network does not automatically lead to process disruption. A practical approach in five steps:

1. Map your installation - an up-to-date asset inventory and network map; without that baseline, anomalies go unnoticed.
2. Separate and restrict - network segmentation following the Purdue Model and IEC 62443, with a jump server and MFA for all remote access.
3. Detect behaviour - passive anomaly detection on OT protocols, connected to a SIEM or OT SOC with current threat intelligence on known groups.
4. Protect the control layer - patch management where possible, code signing and checks on changes to PLC programs, plus the Zero Trust principle: no default trust inside the network.
5. Prepare recovery - a rehearsed incident response plan, offline backups of PLC projects and a plan to operate the process manually.

In IEC 62443, an APT corresponds to the threat level of security levels 3 and 4: attackers with sophisticated means and specific knowledge of industrial systems. NIST SP 800-82 describes the matching OT controls, and NIST SP 800-53 Rev. 5 explicitly requires a threat hunting capability in control RA-10.

🇳🇱 How big is the APT threat in the Netherlands?

The Netherlands is not a theoretical target. In February 2024, the Dutch intelligence services MIVD and AIVD disclosed that Chinese state hackers had used a vulnerability in FortiGate firewalls (CVE-2022-42475) to break into a Ministry of Defence research network with fewer than fifty users; because that network was segmented, the damage stayed limited. The services later reported that the same actor gained access to at least 20,000 FortiGate systems worldwide within a few months in 2022 and 2023. In August 2025, the MIVD and AIVD confirmed that the Chinese group Salt Typhoon had reached routers of smaller Dutch internet and hosting providers.

The Dutch Cyberbeveiligingswet (Cybersecurity Act), in force since 15 August 2026, requires essential and important entities to take appropriate security measures and to report significant incidents to the CSIRT, which for most sectors is the NCSC. Under the reporting obligation, an early warning within 24 hours is followed by a notification within 72 hours and a final report within one month. A suspected APT intrusion almost always meets that threshold.

❓ Frequently asked questions

What is the difference between an APT and ransomware?

An APT wants long-term, undetected access in order to spy or prepare sabotage, and is usually backed by a state. Ransomware groups want quick money and deliberately make themselves visible by encrypting systems. Some state actors do use fake ransomware as a cover, as with NotPetya in 2017.

How long does an APT stay undetected?

According to Mandiant, the median attacker dwell time in 2024 was eleven days, but that figure includes fast ransomware attacks. State-backed APT groups often stay much longer: with Volt Typhoon, US agencies found a presence of at least five years. In OT networks without monitoring, an APT can remain unnoticed even longer.

Why do APT groups target OT?

APT groups target OT because control systems directly run energy, water, transport and production. Access to OT gives a state leverage in a conflict, as the attacks on the Ukrainian power grid in 2015 and 2016 showed. In addition, many OT systems run for years without updates, which makes them an easier target.

Can a small organisation be targeted by an APT?

Yes, small organisations can be targeted by an APT, especially as a supplier, integrator or operator connected to a larger target. Attackers use such parties as a stepping stone to the actual installation. Volt Typhoon, for example, was found at a small municipal electricity and water utility in the United States.

Which standard helps against APT attacks on OT?

IEC 62443 is the most important standard for protecting OT against APTs, because security levels 3 and 4 explicitly assume attackers with sophisticated means and ICS knowledge. NIST SP 800-82 provides practical OT controls, and MITRE ATT&CK for ICS helps align detection with real attack techniques.

Do I have to report a suspected APT intrusion?

If your organisation falls under the Dutch Cybersecurity Act, you report a significant incident with an early warning to the CSIRT within 24 hours, which for most sectors is the NCSC. A suspected APT intrusion in OT almost always meets that threshold. Even without a legal obligation, the NCSC can help with information about the attacker.

📌 In summary

An APT is a patient, well-funded attacker that stays undetected in your network for a long time to spy or to prepare sabotage of the physical process. Groups such as Sandworm and Volt Typhoon show that OT is a strategic target. Defence requires visibility of your assets, strict segmentation, behavioural detection and a rehearsed recovery plan.