Targeted attack

A targeted attack is a highly focused piece of offensive activity, designed to compromise one specific target: an organisation, an individual, or a piece of critical infrastructure.

What characterises it is the planning. The attackers use detailed information about the target to maximise their chances, and they adapt the attack to what they find rather than reusing the same thing everywhere.

Targeted attacks tend to be sophisticated, using custom tooling and evasion to get past defences and reach a specific objective: stealing data, espionage, sabotage, or interrupting operations that matter.

They are the opposite of the indiscriminate, automated end of the spectrum, where commodity malware is sprayed at everybody and whoever is unpatched gets hit.

What characterises it

Reconnaissance first. Before anything is fired, the attackers spend time gathering information about the target’s infrastructure, staff, systems and processes. That includes identifying key employees, mapping what is exposed, and building a picture of which weaknesses exist. Much of it is open source intelligence and leaves no trace on the target’s systems.

Customisation. Tools and techniques are adapted to this target: malware built for the environment, pretexts written around real internal detail, timing chosen around how the organisation actually works.

Multiple phases. Initial access, privilege escalation, persistence, lateral movement and finally exfiltration. Each phase is planned separately, and losing one foothold does not necessarily end the operation.

Staying unseen. Evasion is part of the design rather than an afterthought: living off the land, blending with normal administrative traffic, and choosing the quiet route over the fast one.

A worked example

A technology company is developing a product that has attracted the attention of competitors.

A skilled group decides to go after the intellectual property behind it.

In the reconnaissance phase they identify engineers with access to the design, and use a carefully written phishing message to compromise the credentials of a senior one.

Once inside, they map the network with tooling chosen to look ordinary, escalate where they can, and move on quietly. Over several weeks they establish enough persistence that losing one account would not cost them the access, and eventually reach and exfiltrate the material they came for.

The intrusion is discovered later, when somebody notices traffic that does not fit and an investigation follows the thread backwards. That timing is the whole point: what decided the outcome was not the perimeter, it was how long the movement inside went unnoticed.

Targeted attack, APT and spear phishing

All three describe attacks against a chosen target, and all three get used interchangeably, especially in the press.

The targeted attack is the category: somebody chose you, and adapts the attack to what you are, instead of firing the same thing at everyone to see what lands.

An advanced persistent threat adds two things: resources and permanence. It did not just choose you; it is prepared to stay for months and values quiet access more than immediate gain. Every APT is a targeted attack; not every targeted attack is an APT. A CEO fraud aimed at one finance manager is targeted and is over in a week.

Spear phishing is not a category but a vector: the message written for one person using real detail about them. It is the most common way a targeted attack starts, and it also shows up in attacks that are not targeted at all.

The word advanced misleads, and it is worth saying so: the way in is almost never exotic. An email to four people, a supplier with network access, an unpatched device on the perimeter, or credentials bought from a broker. What is sophisticated comes afterwards, in the care taken once inside.

From that follows the practical consequence: against somebody who is going to keep trying for months, betting everything on prevention is the wrong bet. The question that matters is how long it takes to notice movement on the inside, and that is a question about detection and response.

In one sentence: targeted says who, APT says with how many resources and for how long, and spear phishing says how they got in.

Where to read more

MITRE ATT&CK: the framework that catalogues the tactics, techniques and procedures seen in real intrusions, including the ones typical of targeted operations.

Mandiant M-Trends: an annual analysis of intrusion trends, including dwell time, which is the number that tells you how long attackers stay before somebody notices.