Cyber Kill Chain-Based Taxonomy of Advanced Persistent Threat Actors: Analogy of Tactics, Techniques, and Procedures

The need for cyber resilience is increasingly important in our technology-dependent society where computingdevices and data have been, and will continue to be, the target of cyber-attackers, particularly advancedpersistent threat (APT) and nation-state/sponsored actors. APT and nation-state/sponsored actors tend to bemore sophisticated, having access to significantly more resources and time to facilitate their attacks, which inmost cases are not financially driven (unlike typical cyber-criminals). For example, such threat actors oftenutilize a broad range of attack vectors, cyber and/or physical, and constantly evolve their attack tactics. Thus,having up-to-date and detailed information of APT’s tactics, techniques, and procedures (TTPs) facilitates thedesign of effective defense strategies as the focus of this paper. Specifically, we posit the importance oftaxonomies in categorizing cyber-attacks. Note, however, that existing information about APT attackcampaigns is fragmented across practitioner, government (including intelligence/classified), and academicpublications, and existing taxonomies generally have a narrow scope (e.g., to a limited number of APTcampaigns). Therefore, in this paper, we leverage the Cyber Kill Chain (CKC) model to “decompose” anycomplex attack and identify the relevant characteristics of such attacks. We then comprehensively analyze morethan 40 APT campaigns disclosed before 2018 to build our taxonomy. Such taxonomy can facilitate incidentresponse and cyber threat hunting by aiding in understanding of the potential attacks to organizations as wellas which attacks may surface. In addition, the taxonomy can allow national security and intelligence agenciesand businesses to share their analysis of ongoing, sensitive APT campaigns without the need to disclose detailedinformation about the campaigns. It can also notify future security policies and mitigation strategy formulation. KCI Citation Count: 1