Top 10 Advanced Persistent Threat (APT) Groups of 2024

Sophistication: The level of technical expertise demonstrated in their attacks, including the use of zero-day exploits, custom malware, and advanced evasion techniques.

Impact: The scale and severity of their attacks, measured by data breaches, financial losses, disruption of critical services, and geopolitical consequences.

Persistence: Their ability to maintain long-term access to compromised systems, enabling sustained espionage or sabotage.

Innovation: The development and deployment of new attack methods and tools that push the boundaries of cyber warfare.

Geographic Reach: The extent to which their attacks span across different countries and regions.

Strategic Alignment: The degree to which their activities support the political, economic, or military objectives of their state sponsors.

Notable Activities in 2024: Lazarus extended its DeathNote (Operation DreamJob) campaign, targeting nuclear sector employees. Exploited a Google Chrome zero-day via a fake DeFi game and developed a macOS persistence technique using extended attributes (EAs). Fake job lures continue to be a favorite tactic.

Why They Made the List: Lazarus Group's continued innovation, diversification of targets, and proven ability to generate illicit revenue make them a top-tier threat. Their collaboration with ransomware operations is also a growing concern.

Notable Activities in 2024: APT29 launched phishing campaigns using Zero Trust Architecture (ZTA) themes to steal Windows credentials via RDP. They also employed ROOTSAW/EnvyScout (malware dropper) and WINELOADER (a new variant) with DLL sideloading for stealth.

Why They Made the List: APT29's persistence, advanced techniques, and strategic targeting underscore their importance as a top-tier espionage threat. The group's campaigns are meticulously planned and executed.

Notable Activities in 2024: Volt Typhoon revived botnet operations, compromising Cisco RV320/325 routers and Netgear firewalls for stealthy command-and-control (C2) communication.

Why They Made the List: Volt Typhoon's focus on critical infrastructure makes them an exceptionally dangerous actor. The group's stealthy tactics and use of compromised network devices highlight the challenges of detecting and preventing their attacks. The usage of Living off the Land techniques contributes to their success.

Notable Activities in 2024: OilRig used TemplePlay and ViroGreen malware and employed sophisticated techniques to maintain persistence, including the use of legitimate Iranian antivirus software components.

Why They Made the List: OilRig's role as an access broker amplifies the impact of other Iranian APT groups, making them a critical component of the Iranian cyber threat ecosystem.

Notable Activities in 2024: RomCom deployed two zero-day vulnerabilities (Mozilla & Windows) to deliver its backdoor. It shifted toward intelligence-gathering efforts, targeting entities primarily in Europe and North America.

Why They Made the List: The use of zero-days and the shift in focus demonstrate the group's capacity for technical innovation and adaptability. Addressing software and data integrity failures is crucial to defend against such groups.

Notable Activities in 2024: Exploited VPNs, firewalls, and email servers to deploy SNAPPYBEE, DEMODEX, and GHOSTSPIDER for persistent access. They are known to exploit well-documented vulnerabilities (CVE-2023-46805, CVE-2024-21887, CVE-2023-48788, CVE-2022-3236, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065).

Why They Made the List: The group's persistent attacks against critical infrastructure and exploitation of known vulnerabilities demonstrate their commitment to long-term intelligence gathering. Patch management strategy is critical to defend against these attacks.

Notable Activities in 2024: Targeted aerospace, aviation, and defense sectors via fake job offers (SnailResin malware) and used advanced evasion techniques. Charming Kitten used BellaCPP malware (a C++ variant of BellaCiao) for persistent access, targeting entities in the Middle East.

Why They Made the List: Charming Kitten's diverse targeting, sophisticated social engineering tactics, and willingness to engage in hack-and-leak operations make them a significant threat to a wide range of organizations. Email authentication mechanisms such as SPF and DKIM, can help mitigate these attacks.

Notable Activities in 2024: Kimsuky ramped up credential theft operations, spoofing Russian domains to bypass email security measures. They employ a strategy of registering malware as a service for reliable persistence.

Why They Made the List: Kimsuky's persistence, sophisticated social engineering tactics, and focus on supply chain attacks make them a significant threat to organizations in South Korea and beyond. Defending against supply chain attacks is critical to defend against these attacks.

Notable Activities in 2024: Exploited fraudulent Army+ websites to target Ukrainian soldiers.

Why They Made the List: Sandworm's proven capability to carry out large-scale disruptive and destructive attacks makes them a major threat to critical infrastructure worldwide.

Notable Activities in 2024: Persistent campaigns against a government entity in Egypt.

Why They Made the List: Although not as technically sophisticated as some other APT groups, Tropic Trooper's persistence and focus on a strategically important region make them a noteworthy threat.

The Rise of Initial Access Brokers: Groups like OilRig demonstrate the growing specialization within the cybercrime ecosystem.

Exploitation of Known Vulnerabilities: The exploitation of known vulnerabilities remains a persistent problem.

Zero-Day Vulnerabilities in the Spotlight: APTs are increasingly leveraging zero-day vulnerabilities.

Cloud Services as a Prime Target: Cloud environments are now firmly in the crosshairs of APT groups.

Geopolitical Tensions Fueling Cyber Activity: Geopolitical conflicts and tensions are driving an increase in state-sponsored cyberattacks.

Implement a Robust Threat Intelligence Program: Stay informed about the latest APT threats and TTPs.

Prioritize Patch Management: Regularly and promptly patch known vulnerabilities in software and hardware.

Enforce Multi-Factor Authentication (MFA): MFA is essential for protecting against credential theft.

Strengthen Network Security: Implement network segmentation, intrusion detection systems, and firewalls.

Train Employees to Recognize Phishing Attempts: Educate employees about social engineering tactics and how to identify suspicious emails and links.

Develop and Test Incident Response Plans: Be prepared to respond quickly and effectively to a cyberattack.

Adopt a Zero Trust Architecture: Limit the impact of breaches by implementing zero trust security principles, verifying every user and device before granting access to resources.

Trend Micro Exposes Earth Estries' Advanced Cyber Espionage Campaign Across 13 Countries

North Korean Hackers Deploy New OtterCookie Malware Targeting Software Developers

Chinese Hackers Breach BeyondTrust Enabling US Treasury Cyber Intrusion

Russian Hackers Target Kazakhstan Diplomatic Files in Strategic Cyber Espionage Campaign

Chinese APT Group Earth Estries Targets Critical Infrastructure with Advanced Cyber Attacks