APT-Grade Capability Is Not Reserved for APTs

“We are not a nation-state target, so APT-grade tooling is outside our threat model.”

Let me stop you right there.

That sentence scopes the threat model by who the attacker is.

The tooling does not check.

APT-grade capability is not reserved for APTs.

Capability is a property of the artifact.

What a sample can do.

What a framework can reach once it is running.

Which credentials it can pull out of memory.

None of that is stored in the operator’s passport.

A cracked copy of a post-exploitation framework does not ask whether the person launching it works for an intelligence service.

It runs.

And it has exactly the capability it had when a better-funded operator ran it last year.

That is the whole problem with scoping a threat model by actor type.

It quietly assumes capability travels with the actor.

It used to be a reasonable approximation.

It stopped being one when the tooling leaked.

1. “But Nobody Spends That Kind of Engineering on a Company Our Size.”

Correct.

Nobody needs to.

The engineering was already spent.

Consider both ends of the build-sophistication axis.

At one end sits Regin.

Analysts trace its samples back to at least 2008.

Its multi-stage, custom-encrypted build represents engineering time that only a well-resourced, likely nation-state operator sustains.

That is what APT-grade used to mean in practice: somebody paid for the capability, so only somebody with that budget had it.

At the other end sits Cobalt Strike, once cracked and leaked.

An operator running it does not build comparable tradecraft.

They receive a framework whose interactive post-exploitation capability already covers most ATT&CK tactic categories, in one integrated tool.

Fortra licenses it legitimately, reportedly at around $3,500 per user.

A pirated copy costs nothing.

So the operator of a leaked copy inherits capability breadth in the neighbourhood of Regin’s, without anything like Regin’s engineering cost.

Sophistication measures what a sample can do. It does not measure who is currently running it.

“Nobody would spend that on us” is true, and irrelevant.

The spending happened upstream.

You are being asked to model the result.

2. “But Cobalt Strike Is a Legitimate Red-Team Product.”

Yes.

That is precisely why it belongs in your threat model.

MITRE ATT&CK files software like it in a Tool category, distinct from software built with malicious intent.

A Tool is usable by “a defender, pen tester, red teamer, or an adversary.”

Read that list again.

The last entry is not a footnote.

Once Cobalt Strike’s source leaked in 2020, cracked copies gave criminal operators the same post-exploitation breadth that Fortra’s paying customers get.

Without the licence fee.

Without any of the defensive intent attaching to the use.

And this is not a theory about what might happen.

Proofpoint tracked it.

Threat-actor use of Cobalt Strike rose 161% from 2019 to 2020.

Over the same period, the share of campaigns attributable to any known, well-resourced threat actor fell from roughly two-thirds in 2016 to 2018, to about 15% from 2019 onward.

The remainder went to unattributed commodity and ransomware-affiliate use.

Do the arithmetic on the share.

About 15% against roughly 67% is about 0.22.

The attributable, well-resourced share of campaigns dropped to under a quarter of what it had been.

The tool stayed the same. The population running it changed.

Mimikatz makes the same point from the other direction.

Benjamin Delpy created it in May 2011, after finding that Windows kept an encrypted copy of a password and the key to decrypt it in memory at the same time.

Microsoft declined to address the flaw that year.

Delpy built the tool to demonstrate the weakness to defenders.

Vendors now detect it broadly, commonly as HackTool:Win32/Mimikatz.

Not because of its origin.

Because of how often attackers repurpose it.

Detected as malware is not created as malware.

And created as a defensive tool is not the same as being run defensively on your network this afternoon.

3. “But WannaCry Was Years Ago and Everyone Patched.”

You are treating WannaCry as a news story.

It was a demonstration.

On 12 May 2017, WannaCry spread using EternalBlue, an SMB exploit developed by the NSA.

The Shadow Brokers had leaked it about a month earlier.

It hit systems that were still unpatched, despite Microsoft’s MS17-010 fix, issued two months before the attack.

Line those dates up.

Fix two months before the attack.

Leak one month before the attack.

So the patch existed roughly a month before the exploit was public.

The capability was built by a state, published by a leak, and aimed by whoever picked it up, at whatever was still exposed.

That is what the 2017 threshold broke.

The distinction between a “nation-state threat” and an “opportunistic mass-exploitation threat” assumed the two used different tools.

After a leak, they don’t.

NotPetya followed on 27 June 2017.

Same EternalBlue exploit.

Delivered through a compromised Ukrainian tax-software update channel.

Mimikatz-derived credential dumping combined with EternalBlue and EternalRomance.

A wiper disguised as ransomware, with more than $10 billion in estimated global damage.

So, did everyone patch?

That is not a historical question.

It is a measurement about your estate, and it has to be repeated every time the next exploit leaks or goes public.

The assumption 2017 broke was that patch cycles measured in months, and perimeter controls alone, were adequate against self-propagating exploitation of known, already-patched vulnerabilities.

“Everyone patched MS17-010” does not restore that assumption.

It just means the last specific instance is closed.

The mechanism is still open.

4. “But We Have Zero Trust Now, So Resident Attackers Are Handled.”

Maybe resident attackers are handled.

That is a different mechanism.

Zero-trust identity architecture was the correct lesson against a specific target.

An enterprise network with a definable perimeter.

A resident, professional attacker willing to spend months achieving and maintaining access.

Verify identity and device before granting access, and a patient intruder has a much harder time moving.

Good.

Now look at what leaked tooling actually did in 2017.

Mass, indiscriminate exploitation does not primarily succeed because internal detection was thin after the attacker got in.

It succeeds because unpatched, internet-reachable services get exploited automatically, at scale, often within days or hours of public disclosure.

A control built to catch a patient resident adversary is not the control that stops a worm exploiting a two-month-old unpatched SMB vulnerability.

That control is patch velocity.

And exposure reduction.

And NotPetya’s delivery route defeats most of the rest.

The malicious code arrived through a software update channel the organization already trusted and had already authorized.

Zero-trust identity verification is not designed to interrogate that channel.

The update process is itself the trusted actor.

So “we have zero trust” answers one question.

It is a fine answer to that question.

It is not an answer to the question you were asked.

5. “But an Expensive-Looking Attack Means a Well-Resourced Attacker.”

It means you saw an expensive-looking capability.

Those are no longer the same observation.

Cheap, leaked commodity tooling can carry APT-grade capability breadth.

So the breadth of what an intruder did on your network is not a reliable signal of what they spent.

What money actually buys shows up on other axes.

Durability.

Regin was built to survive years of quiet operation rather than be thrown away.

Its rarity in public analysis is itself a resilience property.

A tool nobody has fully reverse-engineered cannot be signatured.

Evasion.

A free, off-the-shelf packer like UPX raises the bar for static analysis at essentially zero cost to the operator.

It is also caught in seconds, by its distinctive section markers.

A custom or heavily modified packer costs more to build or license, and defeats the structural and signature checks that catch UPX.

Infrastructure.

Emotet ran under its own name from 2014 to 2021, until an eight-country operation took over at least 700 of its C2 and backup servers on 27 January 2021.

Qakbot ran from 2008 until its 29 August 2023 disruption.

Both relied on centralized C2 that one coordinated action could seize.

ZeroAccess, built as a peer-to-peer botnet, was documented resurfacing even after earlier disruption.

Commodity tooling is disposable by design.

Infrastructure gets seized, samples get signatured, and the operator moves to the next cheap tool.

So when you look at an intrusion, ask which axis you are actually measuring.

Breadth of capability tells you what the tool could do.

It does not tell you who paid for it.

6. “But Every New Technique Is Supposedly the Start of a New Era.”

Fair.

Security commentary does announce a new era roughly every time a vendor needs a new slide.

So hold the 2017 claim to a real test.

A year is not an era boundary.

A threshold is: the dominant motive, the actor type and the broken defensive assumption all shift together.

2017 meets it.

The motive returned to profit, at industrial, indiscriminate scale.

The actor type became criminal operators running leaked state-grade tools.

The broken assumption was that months-long patch cycles and perimeter controls were enough.

Now apply the same test to the current candidate.

AI-assisted attack tooling is real.

Generated phishing content.

Automated vulnerability discovery.

AI-assisted malware development and obfuscation.

All documented as operationally useful to attackers.

As of this writing, there is no single dated threshold incident that shifted motive, actor type and defensive assumption together for that category.

It may turn out to be a force multiplier inside the mass-exploitation pattern.

Faster, cheaper production of the same phishing and exploitation that already define it.

Era boundaries have only ever been recognized in hindsight, once the institutional response was visible.

So the discipline cuts both ways.

Do not declare a new era because a technique is new.

And do not keep an old era’s threat model because the one that replaced it is no longer new.

7. No, This Does Not Mean Every Company Faces a Regin-Class Operator.

It doesn’t.

Bespoke, durable tooling is still rare.

It is expensive.

It is built to stay quiet for years, which is exactly why its operator does not spend it on targets that a cracked framework would reach just as well.

The patient, well-funded, state operator is a real category.

Whether it is in your threat model still depends on what you hold and who would want it.

Nor does this mean AI-assisted tooling has opened a new era.

The evidence does not support that yet.

The claim here is narrower than either.

Capability that has leaked no longer tells you who is using it.

That is all.

It is enough to break the sentence at the top of this page, because that sentence used the actor to rule out the capability.

Keep the actor type for what it still predicts.

Patience.

Persistence.

Willingness to spend.

Stop using it to decide which tools can reach you.

8. What You Should Actually Do

Scope the threat model by capability and mechanism in circulation. Not by the actor type you expect.

Ask which tooling is publicly available, leaked, cracked or sold as dual-use software.

Then ask what it can do against your estate.

Treat leaked and dual-use tools as in-scope capabilities. Cobalt Strike and Mimikatz belong in the model by name.

Mimikatz found running outside an authorized penetration test is a high-severity indicator.

That holds whatever the vendor label says, whether it calls the file malware or merely a hack tool.

Know when your authorized tests run, so an alert outside that window means something.

Measure patch velocity and internet exposure for vulnerabilities with public exploit tooling. The gap WannaCry used was a fix that existed and was not applied.

Measure that gap as a number, not as a belief.

Measure which of your services are reachable from the internet while it is open.

Name the mechanism each control addresses. Resident-adversary detection.

Patch velocity.

Supply-chain integrity.

If a control’s justification is “zero trust” with no mechanism attached, you have cited an architecture as if it were an answer to every threat category.

It is an answer to some of them.

Date the evidence. The Proofpoint figures, the licence price and today’s state of AI-assisted tooling are all dated.

The principle is durable.

The numbers are not.

9. The Actual Model Is Not Complicated.

Capability lives in the tool. Once the tool leaks, the actor type stops predicting it.

Regin tells you what bespoke engineering buys.

Cobalt Strike tells you what happens when comparable breadth becomes free.

Mimikatz tells you that origin and use are separate facts.

WannaCry and NotPetya tell you that state-developed exploitation reached ordinary unpatched systems about a month after a leak.

You do not have to be a nation-state target to be on the receiving end of nation-state tooling.

You only have to be reachable.

So model what is reachable, what is circulating, and which control addresses which mechanism.

Then let the attacker be whoever they turn out to be.