Comments: Advanced Persistent Threat (APT) - why did we resist so long?

@ iang,

With regards where APT lies within cyber crime/espionage activities it is perhaps best to look first at ordinary or non cyber illicit activities.

There is a spectrum of illicit activities of which there are three levels of practicioner who directly earn money from the proceads of their illicit activity by converting the tangable gains into money. These are the,

1, Oportunistic criminal.
2, Working criminal.
3, Proffesional criminal.

The "oportunistic criminal" is at best the bottom feeder of the criminal food chain they basicaly "see, smash, grab and run" there is no planing involved such as target selection and often no plan for disposing of any gains. Often it is "street crime" such as "mugging" or "handbag snatching" to basic "auto/car contents theft".

The "Working criminal" usually has planing involved in their activites, they select a target look it over, note any visable defences and only procead when they know they have a reasonable chance of success. They usually have a tried and tested method in place to dispose of any gains at a reasonable rate of return. However they are fairly easily detered by obvious defences such as alarms and CCTV and old fashioned bars across windows etc. Effectivly these are the house breakers and burglars of small to medium size businesses, where overly specialist knowledge is not required to obtain the tangable goods.

The "Proffessional criminal" always plans what they do and frequently "steal to order" they are not deterred by ordinary defences and will usually take on only high value crimes such as art theft etc which requires some specialist knowledge.

Often included incorrectly in "proffessional" is "white collar" criminals who defraud businesses etc, they are usually only "proffessional" because of their ordinary everyday job, and tend to be on par with "opportunistic criminals" in outlook.

There are two other levels on the spectrum of illicit activities at either end, in neither of which is the practitioner dependent on the proceads of the crime for a living.

At the bottom you have the "zero's" or "impulse criminals" often drunken idiots that have no sense of awarness take no precautions and basicaly do pointles crime such as stealing road signs etc "for the fun of it". Usually they have absolutly no intension of making a personal gain from the activities. Often they end up on CCTV being candidates for televison programs about "inner city anti-social behaviour", as one career criminal put it without any sense of irony "they are the sort that give crime a bad name".

At the top is a fourth level that is realy a whole new spectrum in it's own right, I would for want of a better word call them "Operators". With main subsets of "Officers", "agents" and "contractors" with further subsets in each of "spooks", "handlers", "squirrels", "legends", "colators" and "techs" which are involved with "movie plot" style illicit activities (many of which are not codefied crimes yet) that in reality could only be carried out with the resources of large corporations or state actors and their agencies.

Invariably the targets of the illicit activities are not tangable goods but intangable information and any actual crime commited is tangental or incidental to the main activity. Out side of the movies these people commit acts of what would be considered "espionage" or "spying" usually by just carefull observation, and news gathering.

Where entry into premises is required they used to be called "black bag jobs" (after the "surgeons" style bag the burglary tools were carried in). These are often carried out by those who have been trained in the techniques of proffessional criminals, but unlike them have gone several steps further with highly specialised knowledge. Often the participents have compleate cover stories or "legends" to not only disguise who they and there employers are but also the actuall target. Legends may spend months or years in "deep cover" getting to the target.

For short notice "insider" activities in the past people employed by utility companies such as the old UK GPO used to be trained and used and were known as "squirrels" (that went out to gather the nuts).

Usually all "operators" plan to keep their activity compleatly undetected from the target organisation and no conventional level of security defences (including guards and dogs) will keep them out especialy when in many cases they become "insiders".

However sometimes it is not possible to "place" an insider so another route in is required and they will if required not hesitate to use methods of coercion most would find unpalatable the aim often to "turn" a person into an "agent" controled by a "handler".

Very infrequently the coercion is physical and direct and these activities are sometimes refered to as "wet work" and they will "clean up" or "cleanse" afterwards.

There are some commercial organisations (such as Kroll) who have been reputed to behave as though they have "state backing" when infact they have not and they have due to lack of suitable caution come very unstuck (which just one of many major reasons they are not state backed).

And yes there are commercial organisations that do have state backing and are used for "deniability" reasons many can be seen as "contractors" in the likes of Afghanistan and Iraq. Broadly they fall into two groups depending on where they are deployed. Those in "remf" positions are sometimes jokingly refered to as "shades" in part from the "sun shades" they wear and in part because a "shade" is also another type of "spook". Those at the sharp end or beyond as "No name, no rank, no shave types" and are often indistinguishable from "Special-Ops" and the press sometimes mistakenly call them "mercenaries" although thay are not "soldiers of fortune" paid to fight.

Contractors can be doing various activities including close protection of Vips, preparing and operating of high tech weapons such as drones, capturing and interogating of "suspects" along with operating "rendition" activities and other intel gathering activites and plain old fashioned sabotage. One such organisation that has got in the news a few times more than it should have is Blackwater although there are many others, many of whom can be seen touting for business in one way or another at certain "Arms fairs".

Posted by Clive Robinson at November 19, 2011 10:21 AM
Post a comment









Remember personal info?






Hit Preview to see your comment.
MT::App::Comments=HASH(0x55fc75e2b160) Subroutine MT::Blog::SUPER::site_url redefined at /home/iang/www/fc/cgi-bin/mt/lib/MT/Object.pm line 125.