{"id":11524,"date":"2025-02-12T10:01:51","date_gmt":"2025-02-12T10:01:51","guid":{"rendered":"\/cybersecurity-blog\/?p=11524"},"modified":"2025-02-12T10:01:51","modified_gmt":"2025-02-12T10:01:51","slug":"track-advanced-persistent-threats","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/","title":{"rendered":"How to Track Advanced Persistent Threats"},"content":{"rendered":"\n<p>Advanced persistent threats (APTs) stand out as one of the most formidable challenges for businesses in the cybersecurity landscape. These threats can cause irreparable damage, leading to financial losses, data breaches, and reputational harm.&nbsp;<\/p>\n\n\n\n<p>APTs are defined as sophisticated targeted attacks typically conducted by highly funded adversaries: national agencies, state-sponsored groups, organized crime groups, corporate espionage actors. &nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Are APTs&nbsp;<\/h2>\n\n\n\n<p>The name speaks for itself, APTs are: &nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Advanced: <\/strong>Having at hackers&#8217; disposal the full (and ever-growing) arsenal of techniques and tools to get and maintain access to the target.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Persistent:<\/strong> The aim is to keep long-term access to the targeted system or network. This involves constant improving and updating of the tools to evade detection.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Threats: <\/strong>Such campaigns are intentionally malicious and inevitably harmful. They are backed by coordinated actions of skilled, motivated, organized, and well-resourced professionals. &nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Why Are APTs a Significant Threat to Businesses&nbsp;<\/h2>\n\n\n\n<p>APTs prefer to target large corporations, government entities, and critical infrastructure. Finance, manufacturing, healthcare, and energy are prime targets for APTs due to the high value of their assets, data and infrastructure. The consequences of a successful APT attack extend beyond financial loss and corporate damage \u2014 they can impact national security, cause market instability, disrupt economies, and put lives at risk.&nbsp;<br>&nbsp;<br>But no business, however modest-scale and unrelated to strategic industries, can consider itself safe:&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Small and medium companies still possess valuable assets, handle sensitive customer information, financial data, or intellectual property&nbsp;<\/li>\n\n\n\n<li>They are part of supply chains that can be disrupted by attacks&nbsp;<\/li>\n\n\n\n<li>A successful infiltration into their communications grants access to larger partners or clients.&nbsp;<\/li>\n\n\n\n<li>Along with all this, they have weaker security posture, invest less in cyber threat prevention.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Detect Early, Defend Better: The Power of Threat Intelligence&nbsp;<\/h2>\n\n\n\n<p><a href=\"https:\/\/any.run\/cybersecurity-blog\/threat-intelligence-explained\/\" target=\"_blank\" rel=\"noreferrer noopener\">Threat intelligence<\/a> is a pivotal element of an APT-resistant cybersecurity strategy. By gathering, analyzing, and applying intelligence on cyber threats, organizations can proactively detect and neutralize them before they escalate. &nbsp;<br>&nbsp;<br>TI provides:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Early Detection<\/strong>: Identifying indicators of compromise (IOCs) before damage occurs.&nbsp;<\/li>\n\n\n\n<li><strong>Behavioral Analysis<\/strong>: Understanding attacker <a href=\"https:\/\/any.run\/cybersecurity-blog\/malware-ttps-explained\/\" target=\"_blank\" rel=\"noreferrer noopener\">tactics, techniques, and procedures<\/a> (TTPs) to anticipate movements.&nbsp;<\/li>\n\n\n\n<li><strong>Threat Hunting<\/strong>: Actively searching for hidden threats within the network.&nbsp;<\/li>\n\n\n\n<li><strong>Stronger Security Posture<\/strong>: Defenses based on real-world threat insights.&nbsp;<\/li>\n\n\n\n<li><strong>Incident Response Efficiency<\/strong>: Rapidly responding to and mitigating APT incidents.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How Threat Intelligence Lookup Facilitates APT Reconnaissance&nbsp;<\/h2>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"600\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup-1024x600.png\" alt=\"\" class=\"wp-image-11560\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup-1024x600.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup-300x176.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup-768x450.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup-1536x901.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup-370x217.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup-270x158.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup-740x434.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/ti_lookup.png 1837w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup helps organizations enrich threat data<\/em> <em>on the latest cyber attacks<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>ANY.RUN\u2019s <a href=\"https:\/\/any.run\/cybersecurity-blog\/introducing-any-run-threat-intelligence-lookup\/\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a> is a solution fit for all these tasks: a state-of-the-art search engine for threat researchers and cybersecurity teams. It provides detailed insights into <a href=\"https:\/\/any.run\/cybersecurity-blog\/indicators-of-compromise\/\" target=\"_blank\" rel=\"noreferrer noopener\">indicators of compromise<\/a> (IOCs), malware behavior, and attack patterns. &nbsp;<br>&nbsp;<br>It supports over <a href=\"https:\/\/any.run\/cybersecurity-blog\/ti-lookup-search-parameters\/\" target=\"_blank\" rel=\"noreferrer noopener\">40 search parameters<\/a> to query a constantly updated database of threat data, collected from millions of public malware and phishing samples and manually analyzed by a team of threat analysts. &nbsp;<br>&nbsp;<br>For a business, it\u2019s a source of actionable information for preventing, detecting and mitigating all sorts of cyberattacks up to APTs, thus avoiding operational disruptions, financial and reputational damages.&nbsp;&nbsp;<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nCollect intelligence on active APTs <br>with<span class=\"highlight\"> ANY.RUN&#8217;s TI Lookup<\/span>&nbsp;   \n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/intelligence.any.run\/plans\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=how_to_track_apts&#038;utm_term=120225&#038;utm_content=linktotiplans\" rel=\"noopener\" target=\"_blank\">\nGet free requests to test it\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">How TI Lookup helps track APTs&nbsp;<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Wicked Panda APT: Closer Look at an Abused Registry Key&nbsp;<\/h3>\n\n\n\n<p>A notorious Chinese APT group, APT41 aka Wicked Panda, employs a PowerShell-backdoor for compromising systems. <\/p>\n\n\n\n<p>To maintain persistence, it adds its payload in Windows registry entry HKCU\\Environment\\UserInitMprLogonScript&nbsp;which allows it to run malicious code automatically at each user login into the system. Besides, the hackers abuse a legitimate Microsoft&#8217;s forfiles.exe utility. &nbsp;<br>&nbsp;<br>This data is enough to combine a query for TI Lookup:<\/p>\n\n\n\n<p><a href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=how_to_track_apts&amp;utm_term=120225&amp;utm_content=linktolookup#%7B%22query%22:%22registryKey:%5C%22HKEY_CURRENT_USER%5C%5C%5C%5CENVIRONMENT%5C%22%20AND%20registryValue:%5C%22*forfiles.exe*%5C%22%20AND%20%20threatName:%5C%22backdoor%5C%22%20AND%20registryName:%5C%22USERINITMPRLOGONSCRIPT%5C%22%22,%22dateRange%22:180%7D\" target=\"_blank\" rel=\"noreferrer noopener\">registryKey:&#8221;HKEY_CURRENT_USER\\ENVIRONMENT&#8221; AND registryValue:&#8221;<em>forfiles.exe<\/em>&#8221; AND threatName:&#8221;backdoor&#8221; AND registryName:&#8221;USERINITMPRLOGONSCRIPT&#8221;<\/a>&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"696\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image-1-1024x696.png\" alt=\"\" class=\"wp-image-11528\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image-1-1024x696.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image-1-300x204.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image-1-768x522.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image-1-1536x1044.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image-1-2048x1392.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image-1-370x251.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image-1-270x183.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image-1-740x503.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>IOC and event search by registry key and value<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<p>From the search results, we can extract additional IOCs associated with such campaigns, like file hashes or mutexes, and use them for setting up threat detection and alerts. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"582\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image2-3-1024x582.png\" alt=\"\" class=\"wp-image-11530\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image2-3-1024x582.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image2-3-300x171.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image2-3-768x437.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image2-3-1536x873.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image2-3-2048x1164.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image2-3-370x210.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image2-3-270x153.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image2-3-740x421.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Sandbox session with an APT41 backdoor attack<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<p>The Tasks tab shows recent sandbox sessions with analysis of the attack. The sessions can be viewed in ANY.RUN\u2019s <a href=\"https:\/\/app.any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=how_to_track_apts&amp;utm_term=120225&amp;utm_content=linktoregistration#register\/\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive Sandbox<\/a> to study TTPs and other components of the attack.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">MuddyWater APT: Identifying a Backdoor via Mutexes&nbsp;<\/h3>\n\n\n\n<p>Another example: MuddyWater APT group from Iran is known for using PackageManager and DocumentUpdater mutexes in their malware campaigns. The mutexes are generated by their BugSleep backdoor. &nbsp;<br>&nbsp;<br>The attack starts through a phishing email, BugSleep gets deployed, creates a mutex and decrypts its configuration, including the addresses of command-and-control servers. This behavior has been observed in MuddyWater campaigns targeting organizations in Israel and other countries.&nbsp;<br>&nbsp;<br>We can accommodate both mutexes into a TI Lookup search request: &nbsp;<br>&nbsp;<br><a href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=how_to_track_apts&amp;utm_term=120225&amp;utm_content=linktolookup#%7B%22query%22:%22(syncObjectName:%5C%22PackageManager%5C%22%20or%20syncObjectName:%5C%22DocumentUpdater%5C%22)%20and%20syncObjectOperation:%5C%22Create%5C%22%20and%20threatName:%5C%22muddywater%5C%22%22,%22dateRange%22:180%7D\" target=\"_blank\" rel=\"noreferrer noopener\">(syncObjectName:&#8221;PackageManager&#8221; or syncObjectName:&#8221;DocumentUpdater&#8221;) and syncObjectOperation:&#8221;Create&#8221; and threatName:&#8221;muddywater&#8221;<\/a>&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"686\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image5-1-1024x686.png\" alt=\"\" class=\"wp-image-11535\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image5-1-1024x686.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image5-1-300x201.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image5-1-768x515.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image5-1-1536x1030.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image5-1-370x248.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image5-1-270x181.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image5-1-740x496.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image5-1.png 2032w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Mutex name search results in TI Lookup Synchronization tab<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<p>Diving deeper in the search results, we can identify the actual samples that use this mutex.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"438\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image4-1-1024x438.png\" alt=\"\" class=\"wp-image-11536\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image4-1-1024x438.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image4-1-300x128.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image4-1-768x328.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image4-1-1536x657.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image4-1-370x158.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image4-1-270x115.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image4-1-740x317.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/image4-1.png 1653w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Bugsleep backdoor and its behavior demonstrated by the ANY.RUN Sandbox<\/em>\u00a0\u00a0<\/figcaption><\/figure><\/div>\n\n\n<p>We can navigate to the sandbox sessions where these mutexes were used to explore the threat and its behavior in greater detail.<\/p>\n\n\n\n<!-- CTA Split START -->\n<div class=\"cta-split\">\n<div class=\"cta__split-left\">\n\n<!-- Image -->\n<img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/mcusercontent.com\/663b94f19348582a8dc323efe\/images\/0d88188b-3e89-2314-5a60-cb87e8077326.png\" alt=\"Enrich your threat knowledge with TI Lookup\" class=\"cta__split-icon\" \/>\n<\/div>\n\n<div class=\"cta__split-right\">\n<div>\n\n<!-- Heading -->\n<h3 class=\"cta__split-heading\"><br>Learn to Track Emerging Cyber Threats<\/h3>\n\n<!-- Text -->\n<p class=\"cta__split-text\">\nCheck out expert guide to collecting intelligence on emerging threats with <span class=\"highlight\">TI Lookup<\/span>\n\n<br \/>\n<\/p>\n<\/div>\n<!-- CTA Link -->\n<a target=\"_blank\" rel=\"noopener\" id=\"article-banner-split\" href=\"https:\/\/any.run\/cybersecurity-blog\/emerging-threats\/\"><div class=\"cta__split-link\">Read full guide<\/div><\/a>\n<\/div>\n<\/div>\n<!-- CTA Split END -->\n<!-- CTA Split Styles START -->\n<style>\n.cta-split {\noverflow: hidden;\nmargin: 3rem 0;\ndisplay: grid;\njustify-items: center;\nborder-radius: 0.5rem;\nwidth: 100%;\nmin-height: 25rem;\ngrid-template-columns: repeat(2, 1fr);\nborder: 1px solid rgba(75, 174, 227, 0.32);\nfont-family: 'Catamaran Bold';\n}\n\n.cta__split-left {\ndisplay: flex;\nalign-items: center;\njustify-content: center;\nheight: 100%;\nwidth: 100%;\nbackground-color: #161c59;\nbackground-position: center center;\nbackground: rgba(32, 168, 241, 0.1);\n}\n\n.cta__split-icon { \nwidth: 100%;\nheight: auto;\nobject-fit: contain;\nmax-width: 100%;\n}\n\n.cta__split-right {\ndisplay: flex;\nflex-direction: column;\njustify-content: space-between;\npadding: 2rem;\n}\n\n.cta__split-heading { font-size: 1.5rem; }\n\n.cta__split-text {\nmargin-top: 1rem;\nfont-family: Lato, Roboto, sans-serif;\n}\n\n.cta__split-link {\npadding: 0.5rem 1rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: white;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\ndisplay: block;\nz-index: 1000;\nposition: relative;\ncursor: pointer !important;\n}\n\n.cta__split-link:hover {\nbackground-color: #68CBFF;\ncolor: white;\ncursor: pointer;\n}\n\n.highlight { color: #ea2526;}\n\n\n\/* Mobile styles START *\/\n@media only screen and (max-width: 768px) {\n\n.cta-split {\ngrid-template-columns: 1fr;\nmin-height: auto;\n}\n\n.cta__split-left {\nheight: auto;\nmin-height: 10rem;\n}\n\n\n.cta__split-left, .cta__split-right {\nheight: auto;\n}\n\n.cta__split-heading { font-size: 1.2rem; }\n\n.cta__split-text { font-size: 1rem; }\n.cta__split-icon {\nmax-height: auto;\nobject-fit: cover;\n}\n\n}\n\/* Mobile styles END *\/\n<\/style>\n<!-- CTA Split Styles END -->\n\n\n\n<h3 class=\"wp-block-heading\">Lazarus Group: Following North Korea&#8217;s Biggest APT<\/h3>\n\n\n\n<p>Lazarus is one of the most active threats coming from North Korea. The group has been involved in many cyber attacks on both businesses and individuals. One of the recent <a href=\"https:\/\/any.run\/cybersecurity-blog\/invisibleferret-malware-analysis\/\" target=\"_blank\" rel=\"noreferrer noopener\">examples<\/a> involved conducting fake interviews with tech professionals to install malicious programs on their devices.<\/p>\n\n\n\n<p>With TI Lookup, we can not only explore the most recent samples and collect indicators related to Lazarus but also subscribe to receive updates on specific queries.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"607\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus_2-1024x607.png\" alt=\"\" class=\"wp-image-11566\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus_2-1024x607.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus_2-300x178.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus_2-768x456.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus_2-1536x911.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus_2-2048x1215.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus_2-370x219.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus_2-270x160.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus_2-740x439.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup lets users subscribe to specific queries and receive updates on new results<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>Let&#8217;s use the simple query like <a href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=how_to_track_apts&amp;utm_term=120225&amp;utm_content=linktolookup#{%22query%22:%22threatName:%5C%22lazarus%5C%22%22,%22dateRange%22:180}\" target=\"_blank\" rel=\"noreferrer noopener\">threatName:&#8221;lazarus&#8221;<\/a> and click the bell icon to subscribe to updates.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"679\" height=\"552\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus.png\" alt=\"\" class=\"wp-image-11567\" style=\"width:418px;height:auto\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus.png 679w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus-300x244.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus-370x301.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/02\/lazarus-270x219.png 270w\" sizes=\"(max-width: 679px) 100vw, 679px\" \/><figcaption class=\"wp-element-caption\"><em>TI Lookup lists all of your subscriptions along with info on new results<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>As soon as new indicators or sandbox sessions relevant to the query appear in TI Lookup&#8217;s database, we will be notified about them.<\/p>\n\n\n\n<p><a href=\"https:\/\/any.run\/cybersecurity-blog\/ti-lookup-notifications\/\" target=\"_blank\" rel=\"noreferrer noopener\">Learn more about notifications in TI Lookup<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion&nbsp;<\/h2>\n\n\n\n<p>APTs represent a high level of cyber threat due to their strategic nature, the resources behind them, and their capability to adapt and evolve over time. Organizations, especially those in critical sectors or handling sensitive information, need robust cybersecurity strategies to defend against such threats. Threat intelligence is a cornerstone of such a strategy, and TI Lookup from ANY.RUN has proven itself as a comprehensive tool for fueling intelligence with fresh contextual data.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN<\/h2>\n\n\n\n<p><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=how_to_track_apts&amp;utm_term=120225&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a> helps more than 500,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, <a href=\"https:\/\/any.run\/cybersecurity-blog\/introducing-any-run-threat-intelligence-lookup\/\" target=\"_blank\" rel=\"noreferrer noopener\">TI Lookup<\/a>, <a href=\"https:\/\/any.run\/cybersecurity-blog\/yara-search\/\" target=\"_blank\" rel=\"noreferrer noopener\">YARA Search<\/a>, and <a href=\"https:\/\/any.run\/cybersecurity-blog\/threat-intelligence-feeds\/\" target=\"_blank\" rel=\"noreferrer noopener\">Feeds<\/a>, help you find IOCs or files to learn more about the threats and respond to incidents faster.<\/p>\n\n\n\n<p><a href=\"https:\/\/any.run\/demo\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=how_to_track_apts&amp;utm_term=120225&amp;utm_content=linktodemo\" target=\"_blank\" rel=\"noreferrer noopener\">Request free trial of ANY.RUN&#8217;s services \u2192<\/a>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Advanced persistent threats (APTs) stand out as one of the most formidable challenges for businesses in the cybersecurity landscape. These threats can cause irreparable damage, leading to financial losses, data breaches, and reputational harm.&nbsp; APTs are defined as sophisticated targeted attacks typically conducted by highly funded adversaries: national agencies, state-sponsored groups, organized crime groups, corporate [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":11556,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[57,10,40],"class_list":["post-11524","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-instructions","tag-anyrun","tag-cybersecurity","tag-malware-behavior"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Track Advanced Persistent Threats - ANY.RUN&#039;s Cybersecurity Blog<\/title>\n<meta name=\"description\" content=\"Learn how TI Lookup from ANY.RUN helps businesses collect intelligence on active Advanced Persistent Threats to prevent cyber attacks.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\/\/any.run\/\"},\"headline\":\"How to Track Advanced Persistent Threats\",\"datePublished\":\"2025-02-12T10:01:51+00:00\",\"dateModified\":\"2025-02-12T10:01:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/\"},\"wordCount\":1206,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware behavior\"],\"articleSection\":[\"Instructions on ANY.RUN\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/\",\"name\":\"How to Track Advanced Persistent Threats - ANY.RUN&#039;s Cybersecurity Blog\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/\"},\"datePublished\":\"2025-02-12T10:01:51+00:00\",\"dateModified\":\"2025-02-12T10:01:51+00:00\",\"description\":\"Learn how TI Lookup from ANY.RUN helps businesses collect intelligence on active Advanced Persistent Threats to prevent cyber attacks.\",\"breadcrumb\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Instructions on ANY.RUN\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/category\/instructions\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How to Track Advanced Persistent Threats\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/any.run\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\/\/any.run\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\/\/any.run\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/www.any.run\/\",\"https:\/\/twitter.com\/anyrun_app\",\"https:\/\/www.linkedin.com\/company\/30692044\",\"https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Track Advanced Persistent Threats - ANY.RUN&#039;s Cybersecurity Blog","description":"Learn how TI Lookup from ANY.RUN helps businesses collect intelligence on active Advanced Persistent Threats to prevent cyber attacks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"How to Track Advanced Persistent Threats","datePublished":"2025-02-12T10:01:51+00:00","dateModified":"2025-02-12T10:01:51+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/"},"wordCount":1206,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"keywords":["ANYRUN","cybersecurity","malware behavior"],"articleSection":["Instructions on ANY.RUN"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/","url":"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/","name":"How to Track Advanced Persistent Threats - ANY.RUN&#039;s Cybersecurity Blog","isPartOf":{"@id":"https:\/\/any.run\/"},"datePublished":"2025-02-12T10:01:51+00:00","dateModified":"2025-02-12T10:01:51+00:00","description":"Learn how TI Lookup from ANY.RUN helps businesses collect intelligence on active Advanced Persistent Threats to prevent cyber attacks.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/track-advanced-persistent-threats\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Instructions on ANY.RUN","item":"https:\/\/any.run\/cybersecurity-blog\/category\/instructions\/"},{"@type":"ListItem","position":3,"name":"How to Track Advanced Persistent Threats"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/twitter.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/11524"}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=11524"}],"version-history":[{"count":29,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/11524\/revisions"}],"predecessor-version":[{"id":11692,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/11524\/revisions\/11692"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/11556"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=11524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=11524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=11524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}