Global Cyber Threat Actors: APT (Advanced Persistent Threats)

July 26, 2025

Global Cyber Threat Actors: APT (Advanced Persistent Threats)

Chapter 1: Introduction to the Modern Threat Landscape

This introductory section will establish the basic concepts necessary to understand the detailed actor profiles that follow. It will define what an APT means in the modern context and address the confusing landscape of threat actor naming conventions, which is a key challenge for practitioners.

1.1 Advanced Persistent Threat (APT) Definition

Key Features: An APT will be defined as not just malware but a sophisticated, sustained cyber attack campaign in which an intruder establishes a long-lasting and undetectable presence with the aim of stealing sensitive data. Its main qualities are:
Advanced (full-spectrum intelligence gathering techniques), Persistent (directed at specific targets, not opportunistic), and Threat (human-led, not just automated means).
Motivations and Goals: The primary goals of APTs fall into four main categories: Cyber â€‹â€‹Espionage (theft of state secrets or intellectual property), e-Crime (for financial gain), Hacktivism, and Disruption. These motivations are often political or economic and target a wide range of sectors, such as government, defence, finance and industry.
APT Lifecycle: A brief overview of the typical attack chain will be presented: initial infiltration (usually through social engineering), expansion (privilege escalation and lateral movement), and exfiltration (data exfiltration). This lays the groundwork for understanding TTPs (Tactics, Techniques and Procedures), which will be discussed in detail in the following sections.

1.2 Difficulty of Attribution and Naming Conventions

The "Tower of Babel" Problem: This subsection will explain why a universal naming standard for threat actors is impractical and may not be possible. Because different security vendors (Microsoft, CrowdStrike, Mandiant, Kaspersky, Palo Alto Networks, etc.) have their own telemetry, visibility, and internal research priorities, they develop unique naming schemes. This creates a "Rosetta Stone" problem for defenders who must correlate intelligence from multiple sources.
Provider Taxonomies: The high-level logic of the major provider naming schemes will be introduced to provide a mental model for the aliases the reader will encounter.
Microsoft: Uses a weather-themed taxonomy. Family names such as "Blizzard" (Russia), "Typhoon" (China), "Sandstorm" (Iran) and "Sleet" (North Korea) indicate nation-state origins, while "Tempest" indicates financially motivated actors. Newly discovered activities are indicated by "Storm" and a numerical code.
CrowdStrike: Uses an animal-themed rule. National animals are used for nation-states ("Bear" for Russia, "Panda" for China, "Kitten" for Iran, "Chollima" for North Korea). Financially motivated groups are called "Spiders" and hacktivists are called "Jackals".
Mandiant (Google Cloud): Historically uses a numerical system: "APT" for state-sponsored espionage groups (e.g. APT28, APT29) and "FIN" for financially motivated actors (e.g. FIN7). Uncategorized groups are called "UNC".
Palo Alto Networks (Unit 42): Uses a celestial theme; constellations are used for motivations (e.g. "Libra" for financial) and mythological creatures for nation-states (e.g. "Ursa" for Russia, "Serpens" for Iran).
Kaspersky: Often uses names derived from malware artifacts or campaign characteristics (e.g. "Sofacy" for APT28, "Lazarus" for the North Korean group).
Industry Collaboration: Note will highlight the recent strategic alliance between Microsoft and CrowdStrike to analyze adversary names and create a cohesive mapping. This suggests that although a single standard is unlikely, better correlation is an industry goal.

The existence of different and complex naming schemes directly reflects the structure of the cybersecurity industry: a competitive market of private organizations, each with private data. While this fragmentation is a rich and diverse source of intelligence, it inherently creates an operational burden on defenders who must synthesize these disparate streams. The challenge for a Security Operations Center (SOC) analyst is not just technical (detecting the threat) but alsois analytical (correlating intelligence about the threat). The primary value of this report is to serve as a tool to fill this analytical gap.

Threat Actor Taxonomy RosettaÂ Stone

This table acts as a "Rosetta Stone," providing a means of resolving name conflicts at a glance. A user who comes across the "Typhoon" actor in a Microsoft report can instantly recognize it as a China-affiliated group and cross-reference it with "Panda" reports from CrowdStrike. This allows the user to navigate the complex intelligence environment and makes the rest of the report more understandable and useful.

Part 2: Russia-Linked Threat Actors

This section will detail the threat actors attributed to the Russian Federation, which is known for its sophisticated espionage, disruptive capabilities, and integrated "information conflict" doctrines.

2.1 APT28 (Fancy Bear / Forest Blizzard)

Aliases: An extensive list including Fancy Bear (CrowdStrike), Forest Blizzard, STRONTIUM (Microsoft), Sofacy (Kaspersky), Sednit (ESET), Pawn Storm (Trend Micro), IRON TWILIGHT (Secureworks), Tsar Team, Group 74, APT 28, G0007 and more.
Attribution and Motivation: Attributed with high confidence to the Main Intelligence Directorate (GRU) of the Russian General Staff, specifically unit 26165. Their motivation is primarily military and political espionage and is aligned with the interests of the Russian government. They do not appear to engage in widespread intellectual property theft for economic gain.
Target Profile: Its targets include government, military and security organizations, especially NATO and Transcaucasian states. They have also targeted the defense sector, energy, media, civil society and international institutions such as the World Anti-Doping Agency (WADA) and the Organization for the Prohibition of Chemical Weapons (OPCW).
Operational Summary and TTPs: Active since at least 2004, APT28 is known for its aggressive and high-impact operations.
Notable Campaigns: The takeover of the Democratic National Committee (DNC) in 2016, the cyber attack on the German Bundestag (Bundestag) in 2015, and the "hack-and-leak" operations against WADA. They are currently waging a widespread cyberespionage campaign against logistics and technology companies supporting Ukraine.
Initial Access: They rely heavily on spear-phishing attacksÂ containing malicious links or attachments, harvesting credentials through fake websites, and exploiting public-facing applications, especially email servers and routers.
Post-Exfiltration: They use a mixture of proprietary malware such as X-Agent, Zebrocy, Sofacy and public tools such as Mimikatz, Cobalt Strike. A key TTP is their use of "hacktivist" identities such as Guccifer 2.0 and "Fancy Bears' Hack Team" to leak stolen data and further their information operations, giving them plausible deniability.

2.2 APT29 (Cozy Bear / Midnight Blizzard)

Nicknames: Cozy Bear (CrowdStrike), Midnight Blizzard, NOBELIUM (Microsoft), The Dukes, IRON HEMLOCK, UNC2452, APT29, G0016.
Attribution and Motivation: Attributed to the Russian Foreign Intelligence Service (SVR). Their primary motivation is long-term intelligence gathering and espionage, focused on gathering foreign policy, diplomatic, and geopolitical data that will advantage the Russian state.
Target Profile: Targets government networks, diplomatic organizations, think tanks, research institutes and IT service providers in Europe and NATO member countries. They have also targeted organizations involved in COVID-19 vaccine research.
Operational Summary and TTPs: Active since at least 2008, APT29 is known for its stealth, sophisticated tactics, and patience.
Notable Campaigns: 2015â€"2016 DNC infiltration (conducted separately from APT28)Â , 2020 SolarWinds supply chain attack (tracked as UNC2452/NOBELIUM), and recent attacks on Microsoft and TeamViewer in 2024.
Initial Access: They use a wide variety of initial access vectors, including sophisticated spear phishing, supply chain intrusions (SolarWinds), and identity-based attacks such as password spraying against cloud services.
Post-Infiltration: They are known for their special "Duke" family malware (MiniDuke, CozyDuke, etc.). PowerShell and me to evade detectionThey make extensive use of "living off the land" techniques by using legitimate cloud management tools. A key TTP is their misuse of OAuth implementations and stolen tokens for persistence and lateral movement in cloud environments.

2.3 SandwormÂ (APT44)

Nicknames: APT44 (Mandiant), Seashell Blizzard (Microsoft), VOODOO BEAR, IRON VIKING, Telebots.
Attribution and Motivation: Attributed to Military Unit 74455 of the GRU. Sandworm is a dynamic and mature actor active in the full spectrum of espionage, attack and influence operations. Their main motivation is to support Russia's military and political objectives, especially through disruptive and destructive attacks.
Target Profile: It primarily targets government, defense, transportation, energy and media organizations, focusing especially on the "near surroundings" of Ukraine and Russia. They also target Western electoral systems and global critical infrastructure.
Operational Summary and TTPs: Responsible for some of the most significant cyberattacks in history.
Notable Campaigns: 2015 and 2016 Ukrainian power grid attacks, 2017 global NotPetya attack, and sabotage of the 2018 Pyeongchang Olympics. They are currently conducting a high-intensity cyber sabotage campaign in Ukraine using wiper malware.
TTPs: They leverage a wide range of initial access vectors, from exploiting end infrastructure such as routers and VPNs to supply chain infiltrations. They are known for distributing destructive wiper malware and have recently been associated with hacktivist identities such as "CyberArmyofRussia_Reborn" to exfiltrate data and claim responsibility for attacks on critical infrastructure in the US and Europe.

2.4 Gamaredon (Primitive Bear / Aqua Blizzard)

Nicknames: Primitive Bear (CrowdStrike), Aqua Blizzard (Microsoft), Armageddon, Shuckworm.
Attribution and Motivation: Attributed to the Russian Federal Security Service (FSB). Their main motivation is cyber espionage.
Target Profile: Focused almost exclusively on Ukrainian government and military organizations.
Operational Summary and TTPs: A highly active and persistent threat actor known for large-scale spear phishing campaigns. They use specialized malware for command and control (C2) communications and often leverage legitimate software and services.

The GRU/SVR operational dichotomy is evident in the observed TTPs and targeting of these groups. APT28 and APT44, affiliated with the GRU, a military intelligence agency, conduct aggressive and often noisy operations aligned with tactical military and political objectives, such as election interference and subversive attacks. In contrast, APT29, affiliated with the SVR, a foreign intelligence agency, focuses on long-term, covert operations to gather strategic intelligence from diplomatic and policy-making institutions, consistent with traditional foreign espionage, and demonstrates greater operational security and patience. This distinction allows defenders to better predict the enemy's intent based on the detected group.

Additionally, Russian-linked actors tend to use e-crime infrastructure and actors for state goals. This provides plausible deniability and allows access to a broader pool of tools and resources. For example, DanaBot malware operated by Russia-based e-crime group SCULLY SPIDER has been used to launch DDoS attacks against the Ukrainian Ministry of Defense in concert with Russian military targets. The DOJ indictment revealed that DanaBot subbotnets were also used for espionage purposes, a feature of government activities. This implies a strategy within Russia's "information conflict" doctrine that deliberately blurs the lines between state and criminal activity, complicating attribution and intervention for Western nations.

Part 3: China-Linked Threat Actors

This section will detail the threat actors generally attributed to the People's Republic of China, which is characterized by large-scale intellectual property theft, broad-spectrum espionage, and increasing operational sophistication.

3.1 APT1 (CommentÂ Crew)

Pseudonyms: Comment Crew, Shanghai Group, PLA Unit 61398.
Attribution and Motivation: Attributed to People's Liberation Army (PLA) Unit 61398. Basic motivation, economic gain and intellectualIt is cyber espionage for property theft.
Target Profile: A wide range of industries including defence, aerospace and technology.
Operational Summary and TTPs: One of the first APTs publicly announced (by Mandiant in 2013). It is known for long-term infiltrations, with an average residence time of one year in victim networks. They use proprietary malware and public tools like Mimikatz.

3.2 APT10 (Stone Panda / RedÂ Apollo)

Nicknames: Stone Panda (CrowdStrike), Red Apollo, MenuPass, POTASSIUM (Microsoft), Cloud Hopper.
Attribution and Motivation: Attributed to China's Ministry of State Security (MSS), Tianjin State Security Bureau. The motivation is cyber espionage.
Target Profile: The "Cloud Hopper" campaign targets multiple industries globally, including healthcare, defense, aerospace, and managed service providers (MSP).
Operational Summary and TTPs: Known for supply chain attacks targeting MSPs to gain access to their customers. It uses a mixture of specialized malware such as HAYMAKER, SNUGRIDE, and legitimate tools such as PowerShell, WMIExec.

3.3 APT41 (Winnti / BrassÂ Typhoon)

Nicknames: BARIUM, WICKED PANDA, Winnti Group, Double Dragon (CrowdStrike/Mandiant), Brass Typhoon (Microsoft).
Attribution and Motivation: Believed to be Chinese state-sponsored contractors who also conduct financially motivated operations, possibly with the tacit approval of government officials. This creates a unique dual-purpose espionage and cybercrime motivation.
Target Profile: Espionage campaigns target the healthcare, telecommunications and high-tech sectors. Cybercrime attacks focus on the video game industry (manipulating virtual currencies) and ransomware distribution.
Operational Summary and TTPs: It is a prolific and sophisticated actor that has been active since at least 2012. They are known for using a large arsenal of more than 46 different malware families, including backdoors, rootkits, and credential thieves. They often rely on spear phishing attacks involving compiled HTML (.chm) files for initial access.

3.4 Other Important China-Linked Groups:

APT3 (Gothic Panda / Brocade Typhoon): Targets aviation, defense and technology.
APT18 (Dynamite Panda / Wekby): Affiliated with the PLA Navy, targets healthcare, pharmaceuticals and biotechnology.
APT27 (Emissary Panda / Linen Typhoon): Targets government and defense sectors in Central Asia and Europe.
APT31 (Zirconium / Violet Typhoon): Targets political organizations, defense and high technology sectors.
APT40 (Leviathan / Gingham Typhoon): Targets maritime industries and sectors strategic to China's Belt and Road Initiative.

APT41's profile reveals a key trend in Chinese cyber operations: the use of state-contracted actors who are allowed to conduct their own for-profit cybercrime. This dual-purpose model complicates attribution and intervention. For defenders, this means that an infiltration that initially appears to be financially motivated (for example, ransomware targeting a gaming company) could be a precursor or cover for a state-sponsored espionage operation. This requires a more holistic approach to incident response, where motivation is not assumed based on initial indicators alone.

Additionally, the targeting patterns of Chinese APTs are not random; It is strictly aligned with China's national strategic goals, such as the Belt and Road Initiative (APT40) and 5-year economic plans (APT41's intellectual property theft). This demonstrates a direct link between geopolitical/economic policy and cyber operations. This means that organizations can do proactive threat modeling by analyzing China's publicly available strategic documents. If a company operates in an industry identified as a priority for China's development, it is a possible target for a China-related APT.

Part 4: Iran-Linked Threat Actors

This section will cover threat actors attributed to Iran who are notable for their heavy reliance on social engineering, targeting dissidents, and use of a mix of espionage and subversive operations.

4.1 APT33 (Elfin / Peach Sandstorm)

Nicknames: Elfin, Magnallium (Mandiant), HOLMIUM, Peach Sandstorm (Microsoft), Refined Kitten (Crowd)Strike).
Attribution and Motivation: A suspected Iranian government-backed group active since at least 2013. Their motivations include cyber espionage and preparing for potentially disruptive operations against critical infrastructure.
Target Profile: Primarily targets the aviation, energy and government sectors in the USA, Saudi Arabia and South Korea.
Operational Summary and TTPs: Combines low-cost initial access methods with custom-made malware.
Initial Access: Relies on spear phishing attacks with malicious attachments (usually job posting themed) and password sputtering. They are known to exploit publicly disclosed vulnerabilities (N-days).
Malware: Uses specialized malware such as DROPSHOT and SHAPESHIFT, as well as the infamous Shamoon data deletion software. They also use publicly available tools like Mimikatz and LaZagne for credential dumping.

4.2 APT34 (OilRig / Hazel Sandstorm)

Aliases: OilRig, Helix Kitten (Kaspersky), Hazel Sandstorm, EUROPIUM (Microsoft), Crambus, IRN2.
Attribution and Motivation: Affiliated with the Iranian Ministry of Intelligence and Security (MOIS). Active since 2014, their motivation is cyber espionage and intelligence gathering aligned with Iranian state interests.
Target Profile: Broadly targets the financial, government, energy, chemical and telecommunications sectors, with a primary focus on the Middle East.
Operational Summary and TTPs: They are known for using PowerShell-based tools and DNS tunneling for C2.
Campaigns: The 2016 Helminth backdoor campaign and the 2018 QUADAGENT distribution are notable examples. They often conduct supply chain attacks by taking over a less secure organization to achieve their primary goal.
Malware: They use special backdoors such as Helminth and QUADAGENT. A leak in 2019 revealed a significant portion of the toolsets.

4.3 APT35/APT42 (Charming Kitten / Mint Sandstorm)

Nicknames: Charming Kitten, Phosphorus, Magic Hound (CrowdStrike), Mint Sandstorm (Microsoft), Agent Serpens (Palo Alto), Newscaster Team, TA453.
Attribution and Motivation: Attributed to the Iranian Revolutionary Guard Corps (IRGC). Their main motivation is surveillance and information gathering against individuals and organizations of strategic importance to the Iranian government, especially dissidents and enemies of the regime.
Target Profile: Targets journalists, researchers, academics, human rights activists, government officials and the Iranian diaspora abroad.
Operational Summary and TTPs: They are masters of social engineering and deception.
Techniques: They conduct long-term, resource-intensive social engineering campaigns by creating fake identities and websites to build trust and relationships with victims, then send phishing links or malware. They use compromised email accounts and legitimate cloud services to C2 to evade detection. They have also used ransomware in some campaigns.

Iranian APTs, unlike the more technically focused Russian and Chinese groups, demonstrate a mastery and intense dependence on sophisticated and long-term social engineering. They compensate for not using zero-day vulnerabilities by investing in psychological manipulation. Multiple sources indicate that Charming Kitten's (APT35/42) core TTP is to establish trust and rapport over long periods of time before an attack. This differs from the more direct spear phishing or vulnerability exploitation seen from other state actors. This shows that Iran's cyber doctrine gives priority to human intelligence (HUMINT) techniques adapted to the digital domain. For advocates, this simply means that technical controls such as email filtering are inadequate. A strong defense requires solid user security awareness training and processes for authenticating unknown individuals, no matter how plausible they may seem.

Part 5: North Korea-Linked Threat Actors

This chapter will analyze threat actors attributed to the Democratic People's Republic of Korea (DPRK), which has the unique mission of carrying out a combination of state-sponsored espionage and large-scale financial crimes to generate revenue for the regime.

5.1 Lazarus Group (DiamondÂ Sleet)

Aliases: Diamond Sleet, ZINC (Microsoft), HIDDEN COBRA (US Government), Guardians ofPeace, APT38 (Mandiant, for financial operations).
Attribution and Motivation: A North Korean state-sponsored group attributed to the Reconnaissance General Bureau (RGB). They have the dual motivation of traditional espionage and financially motivated attacks, including cryptocurrency theft and bank robberies, to generate illicit revenue in violation of international sanctions.
Target Profile: Espionage targets include media, defense and IT industries globally. Financial targets include banks, financial institutions, and cryptocurrency exchanges and users.
Operational Summary and TTPs: Active since at least 2009.
Notable Campaigns: 2014 Sony Pictures attack (using Destover wiper malware)Â , 2016 Bangladesh Bank heist ($81 million stolen via SWIFT)Â , 2017 WannaCry ransomware attack, and numerous multi-million dollar cryptocurrency heists.
TTPs: They use a wide range of specialized malware such as Destover, Manuscrypt. They often use spear phishing for initial reach and are adept at evading defenses and lateral movement. Their financial subgroup, Bluenoroff, specializes in highly targeted attacks against financial institutions.

5.2 Kimsuky (Emerald Sleet /Â APT43)

Nicknames: Emerald Sleet (Microsoft), Velvet Chollima, Black Banshee (CrowdStrike), THALLIUM, APT43, TA406.
Attribution and Motivation: A North Korean APT group possibly affiliated with the RGB and tasked with global intelligence gathering. Their focus is on foreign policy, national security, and nuclear policy issues related to the Korean peninsula, nuclear policy, and sanctions. They also engage in financially motivated crimes to finance operations.
Target Profile: Primarily targets government organizations, think tanks, journalists and academic experts in South Korea, the USA, Japan and Europe.
Operational Summary and TTPs: Active since at least 2012.
Techniques: They are masters of social engineering and spear phishing, posing as journalists or academics to establish relationships before sending malicious links or attachments. They use specialized malware like BabyShark and leverage legitimate tools like PowerShell and VBScript for execution and persistence. They are known to use malicious browser extensions and exploit misconfigured DMARC policies to advance phishing campaigns.

5.3 Other Notable North Korea-Linked Groups:

APT45 (Andariel / Onyx Sleet): A moderately sophisticated operator, also related to RGB, active since 2009. They conduct espionage against defense and government, but have expanded into financially motivated operations, including the questionable use of MAUI ransomware against hospitals.

North Korea's cyber operations represent the clearest convergence of state espionage with large-scale criminal enterprise. Unlike cases in other nations where e-crime is tolerated or used opportunistically, for the DPRK it is a key pillar of its national strategy to circumvent sanctions and finance its state and military and nuclear programs. The Lazarus Group is clearly associated with major financial heists such as the Bangladesh Bank robbery and numerous cryptocurrency thefts worth hundreds of millions of dollars. The US government and security firms directly state that these activities are intended to generate illegal revenue for the regime. This is not just a "crime"; It is a key component of state-directed financial warfare and foreign policies. This means that any organization in the financial or cryptocurrency sectors is a direct target of a North Korean state actor, not only for espionage but also for outright theft.

Section 6: Other Major Threat Actors

This section will briefly discuss other important state-sponsored and financially motivated groups mentioned in the research material to present a more complete global picture.

6.1 Vietnam Link: APT32 (OceanLotus)

Nicknames: OceanLotus, Canvas Cyclone (Microsoft).
Operational Summary: A Vietnamese state-sponsored group focused on cyber espionage against foreign companies, foreign governments, and political opponents with interests in Vietnam's manufacturing, consumer goods, and hospitality sectors.

6.2 Financially Motivated ActexamplesÂ (e-Crime)

FIN7: A sophisticated and prolific e-crime group known for stealing payment card data by targeting point-of-sale (POS) systems in the restaurant, gaming and hospitality industries.
SCATTERED SPIDER (Octo Tempest): A highly skilled e-crime group known for social engineering attacks targeting IT help desks to gain initial access to large companies, particularly in the telecommunications and BPO sectors.

TTPs used by financially motivated groups such as FIN7 and SCATTERED SPIDER are increasingly similar to those used by nation-states. They demonstrate high levels of operational security, social engineering expertise, and the ability to bypass modern defenses such as MFA. SCATTERED SPIDER's use of vishing and help desk scams is a sophisticated social engineering tactic. The overall trend shows a massive increase in malware-free, identity-based attacks across all threat actors, not just from nation-states. This shows that tools and techniques once considered "advanced" are now part of the standard e-crime playbook. What this means is that, technically and defensively, the distinction between defending between a "nation-state" and a "high-level criminal" is becoming increasingly blurred. Organizations should assume that any adversary can use sophisticated, identity-focused TTPs.

Chapter 7: Strategic Outlook and Defense Requirements

This concluding section will synthesize findings from actor profiles to provide a high-level strategic overview of the current and future threat landscape.

7.1 Key Trends in the APT Environment

Priority of Identity: A clear and general trend is a shift from malware-centric attacks to identity-based infiltrations. Adversaries focus on capturing valid credentials through phishing, password spraying, and social engineering to "log in" rather than "break."
The Rise of the "Hacktivist" Identity: Nation-states, particularly Russia and Iran, are increasingly using fake hacktivist groups as a tool for plausible deniability and to strengthen their influence operations.
Using Supply Chain and Trusted Relationships as Vectors: Sophisticated actors such as APT29 (SolarWinds) and APT10 (Cloud Hopper) have demonstrated the high-impact potential of hijacking software vendors and MSPs to gain access to multiple downstream targets.
Blurring the Lines Between Espionage and e-Crime: The dual mission profiles of groups like APT41 (China) and the entire North Korean cyber apparatus demonstrate that espionage and financial gain motivations are no longer mutually exclusive.

7.2 Defense Requirements for Modern Enterprise

Adopt a Zero Trust Mindset: With attacks focused on identity and "using local tools", traditional perimeter defenses are no longer relevant. Defenses should be built on the principle of "never trust, always verify."
Strengthen the Identity Perimeter: This includes implementing Multi-Factor Authentication (MFA) that is resistant to phishing attacks, eliminating legacy authentication protocols, and implementing robust Identity and Access Management (IAM) and Privileged Access Management (PAM) controls.
Develop Sophisticated Detection Engineering: Defenses must move beyond signature-based detection and focus on behavioral analytics (UEBA) to identify anomalous behavior associated with compromised accounts and malicious use of legitimate tools.
Integrate and Correlate Threat Intelligence: As the naming confusion demonstrates, organizations cannot rely on a single source of intelligence. A key capability is the ability to ingest, correlate and resolve conflicts with intelligence from multiple providers to create a comprehensive operational picture of the threat landscape.

APT groups continue to pose a persistent and dynamic threat to international relations and national security. Countering these threats requires in-depth and continuous threat intelligence work, which requires not only establishing technical defense mechanisms but also understanding actors' motivations, strategic goals and evolving tactics.