What is an advanced persistent threat (APT)?
Advanced persistent threat, written as APT in many defender documents, is a label for a skilled threat actor or group. The NCSC's 4 October 2018 advisory on APT28 describes that group as an Advanced Persistent Threat group and as a highly skilled threat actor. This page explains that usage. It does not give steps, tools or signs. 1
By Secordit. Last checked: 10 November 2026.
How it works
- In this NCSC usage, the label refers to a skilled threat actor or group. 1
- The 4 October 2018 advisory on APT28 describes that group as an Advanced Persistent Threat group and as a highly skilled threat actor. It also lists other public names used for it. 1
- It is a technical advisory written for the network defender community. 1
What UK guidance says
The 2018 advisory includes indicators of compromise and signatures intended to help detect the presence of associated malware on a network, plus high-level mitigation pointers. Those details are not repeated on this page. The advisory is from 2018. In this NCSC usage, an APT is one kind of threat actor. See the threat actor page. 12
Frequently asked questions
What is an advanced persistent threat?
In NCSC usage, it is a label for a skilled threat actor or group. The NCSC's 4 October 2018 advisory on APT28 describes that group as an Advanced Persistent Threat group and as a highly skilled threat actor. 1
Is every cyber incident an APT?
In this NCSC usage, an APT is one kind of threat actor. The 4 October 2018 advisory is a technical advisory written for the network defender community. This page does not say that a household incident is an APT. 1
Does this page list indicators or current groups?
No. The 2018 advisory is a technical advisory written for the network defender community. It lists other public names used for APT28, and includes indicators. Those details are not copied here. The advisory is from 2018. 1
News Pulse
Account security, explained by email.
Sources
- NCSC, Indicators of compromise for malware used by APT28 (opens in a new tab). Accessed 10 November 2026 (Europe/London).
- NCSC, Building a Security Operations Centre: Threat intelligence (opens in a new tab). Accessed 10 November 2026 (Europe/London).