Explain like I'm five · Security

What is an APT?

Advanced Persistent Threat, told as a story about a gang with a royal sponsor that hides for months and wants just one thing: the crown.

an ordinary thiefone night — the bell rings, donethis thiefmonth 3for months — not a soundthe bell is quiet, but the thief is already inside

An ordinary thief takes one night. This thief has been quiet for months.An ordinary thief opens a chest and the bell rings. This one never rang the bell — and is already inside.

wears the carpenter's coatthe doorkeeper waves hellowipes the footprints awaynothing left in the log bookone page a day, no morenever big enough to ring the bellthey never move big, so nobody notices

They disguise themselves, wipe their footprints, and move one page a day.Nothing is left in the log book, and they never move big enough to ring a bell. So nobody notices.

a foreign kingTHE SPONSOR'S NOTEthe crown, just thattake all the time you needdo not get noticedthe persistent gangour crowna sponsor, one target, and all the months it takesthat's why they're called persistent — not one-night thieves

An APT is a persistent gang of thieves with a country behind them.A foreign king pays the bill. The target is one crown. They may take all the time they need. That's what makes them different from a one-night thief.

A sponsorplenty of money and time
Hides for monthsnot just one night
Wipes footprintsnothing left in the log
Moves a little at a timenever enough to ring the bell
FIVE MONTHS OF THE GANG'S PATHJana fake letterFebthe cook's roomMarthe next room's keyAprthe crown roomMayout, one page at a timethe bell never rang onceone step a month — nothing ever rings the bellfive months inside, and nobody knew

One step a month. Five months later they're in the crown room.A fake letter gets them into one room. There they find the next room's key, and move on. Five months inside, and nobody knew.

the next castle saw this gangword from the watchtowerknows who's coming, ahead of timeTHIS GANG'S HABITScarpenter's coatone page a daywipes footprintsthe habits bookknows how they movethe lantern guardgoes looking before any bellit takes all three to find a quiet thief

To catch them you need the watchtower, the habits book, and a lantern.The watchtower friend says who is coming, the habits book says how they move, and the lantern guard goes looking instead of waiting for a bell.

In one breath

APT = a persistent gang with a country behind it that wants one crown, hides for months, wipes its footprints, and moves a little at a time.

Advanced Persistent Threat: a well-funded attack group, often state-sponsored, picks a specific target and stays hidden inside for a long time, moving quietly and stealing information. Catching one takes threat intelligence, TTP analysis, and threat hunting together.

When grown-ups say it

APT (Advanced Persistent Threat)
The gang that waits for months. A sponsor, one target, a long time. Not a one-night thief.
State-sponsored actor
A foreign king pays. So money and time are plentiful. Catch one, and the next gang comes.
Dwell time
From the day they got in to the day they were found. Months is common. Shrinking it is what hunting is for.
Lateral movement
Finding the next room's key from inside one room. Cook's room → next room → crown room. This is what the corridor guard watches for.
Persistence
A back door for getting back in. Block one door and they return through another they dug earlier.
Exfiltration
Sneaking papers out of the castle. All at once would ring the bell, so a little at a time. This is what the red stamp guards against.
Threat group names (APT28 …)
A number and a nickname for each gang. Names like APT28 or Lazarus. The thief encyclopedia lists each gang's habits.
Kill chain
The steps from letter to crown. Cut any step and the whole thing fails. → the seven steps of a thief
Next story
The Seven Steps of a Thief →
Want another term as a picture book? Request →