What Is an Advanced Persistent Threat (APT)? Guide to APT Groups, Attacks & Nation-State Actors
Brief
An advanced persistent threat (APT) is a prolonged, targeted cyberattack in which an intruder, usually a nation-state or state-sponsored group, gains unauthorized access to a network and stays hidden inside it for weeks, months, or years to steal data rather than cause immediate damage.
Unlike a smash-and-grab ransomware hit or a mass phishing campaign, an APT is patient by design: the attacker’s goal is sustained access, not a quick payout.
That patience is measurable. According to Mandiant’s M-Trends 2026 report, the median dwell time for cyber espionage intrusions, the hallmark behavior of an APT, reached 122 days in 2025, and some campaigns have gone undetected for nearly 400 days.