# Advanced Persistent Threat (APT) groups

## Introduction

This page provides a comprehensive overview of Advanced Persistent Threat (APT) groups by country, categorized as Threat Intelligence. It delves into the tactics, techniques, and procedures (TTPs) employed by these groups, mapping them to the [MITRE ATT\&CK framework](https://attack.mitre.org/). The page highlights notable incidents and operations conducted by these threat actors, offering valuable insights into their activities and objectives. This information is crucial for organizations seeking to enhance their cybersecurity strategies and defenses, as it sheds light on the methods and targets of sophisticated cyber adversaries.

Here’s how the information fits into the category of Threat Intelligence:

* **Identification of Threat Actors:** The overview identifies specific APT groups (e.g., Lazarus Group, APT29, APT28) and attributes them to particular nation-states.
* **Tactics, Techniques, and Procedures (TTPs):** The document maps the TTPs of these APT groups to the MITRE ATT\&CK framework, detailing the methods used by these adversaries.
* **Notable Incidents:** It includes descriptions of significant cyber incidents and operations carried out by these groups, providing context for their capabilities and objectives.
* **Target Sectors:** Information about the typical targets of these APT groups (e.g., government networks, financial institutions, critical infrastructure) helps organizations to assess their own risk and prioritize defenses.

By presenting this information, the document can help organizations to develop more effective cybersecurity strategies and defenses.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://calvin-lai.gitbook.io/calvin-lai-security/threat-intelligence/advanced-persistent-threat-apt-groups.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.