Nation-State Actors, APTs and MITRE ATT&CK

Lesson plan

Level

Beginner

Time

About 75 minutes; the steps below add up to 77

Learners compare a smash-and-grab with an intruder who returns quietly for a year, and work out what the second needs and why it is harder to notice, before nation-states or APTs are named. Predictions then precede why a state might pose as protesters, what each word of “advanced persistent threat” means, whether a patient criminal campaign counts as an APT, how an intruder can leave security software nothing to find, and the two questions ATT&CK asks of every action. The habit to build: separate who acted from how they operate, and describe adversary actions by their goal and method.

Objectives

• Describe nation-state actors, what they typically want, and why attribution is hard
• Explain what makes a threat advanced and persistent, and why APT and nation-state are not synonyms
• Explain living off the land and why it is hard to detect
• Use MITRE ATT&CK to name an adversary action by its tactic and technique

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Threat Actor Types and Attack Chain lessons first.
• If you show the ATT&CK website, open the Enterprise matrix in advance; it is large, so zoom to the tactic names first.
• The lesson takes about 77 minutes. To teach it in two parts, stop after “A real example: Volt Typhoon”; the second part opens with “MITRE ATT&CK”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Describe nation-state actors, what they typically want, and why attribution is hard
   • Explain what makes a threat advanced and persistent, and why APT and nation-state are not synonyms
   • Explain living off the land and why it is hard to detect
   • Use MITRE ATT&CK to name an adversary action by its tactic and technique

   Purpose: Learners compare a smash-and-grab with an intruder who returns quietly for a year, and work out what the second needs and why it is harder to notice, before nation-states or APTs are named. Predictions then precede why a state might pose as protesters, what each word of “advanced persistent threat” means, whether a patient criminal campaign counts as an APT, how an intruder can leave security software nothing to find, and the two questions ATT&CK asks of every action. The habit to build: separate who acted from how they operate, and describe adversary actions by their goal and method.

2. 1. Two intruders Think 6 min

   Purpose: Contrast a quick theft with a patient, stealthy intrusion, and find what the second needs.

   Ask

   • What does the second intruder need that the first does not?
   • Which would the office notice, and why?

   Responses to expect

   • Time, money, skill and a goal worth waiting for; push for all four.
   • Some think the long-term visitor is likelier to be seen; ask what trace they leave.
   • On screen in turns: the opening question, its answer; then the question on which intruder is noticed, and its answer.

   Discussion pause: Collect answers to the first question before revealing it.

   In the lesson window

   • Think it through: What would the second intruder need that the first does not?
   • Think it through: Which intruder is the office more likely to notice, and why?

3. 2. Nation-state actors Explain 9 min

   Purpose: Describe nation-state actors, their aims and resources, and why attribution is hard.

   Ask

   • Why might a state disguise an attack as protest?

   Responses to expect

   • Avoiding blame and hiding the real aim usually come first.
   • On screen in turns: the opening; then what nation-state actors typically want, starting with espionage; strategic advantage; disruption; influence; what sets them apart; why their budgets are not unlimited; the question on posing as protesters, and its answer; what attribution means, and why it is hard; plausible deniability, and posing as another actor; false flags, and caution in both directions.

   Misconceptions to challenge

   • A learner may believe: “Nation-states have unlimited budgets.” Respond: Extremely well resourced, but with budgets, priorities and limited skilled staff.
   • A learner may believe: “A serious attack must be a nation-state.” Respond: Impact is not evidence of who acted.

   In the lesson window

   • Think it through: Why might a government want one of its attacks to look as though a protest group carried it out?

4. 3. Advanced persistent threats Predict 8 min

   Purpose: Unpack the three words of APT and the stages of a multi-stage intrusion.

   Ask

   • What should each word in the name mean?

   Responses to expect

   • “Persistent” is often read as “keeps attacking”; steer to “keeps access and returns”.
   • Diagram: step through the stages of the intrusion one at a time, asking what the intruder needs at each before the next appears.
   • On screen in turns: the opening question, its answer; then what each word in APT means; the key characteristics, and a memory shortcut; the stages of a multi-stage intrusion, one at a time; the diagram’s stages one at a time; how an APT differs from a simpler attack chain.

   In the lesson window

   • Think it through: The second intruder’s style has a name: advanced persistent threat. What would you expect each of the three words to mean?

5. 4. Nation-state and APT are not the same thing Predict 4 min

   Purpose: Separate who acts (nation-state) from the style of threat (APT).

   Ask

   • Does a patient criminal campaign count as an APT?

   Responses to expect

   • Many say only states run APTs; ask what the name describes.
   • On screen in turns: the opening question, its answer; then nation-state and APT side by side.

   Misconceptions to challenge

   • A learner may believe: “APT is another word for nation-state.” Respond: One is who; the other is how they operate.

   If the explanation does not land: A professional footballer and a long-range shot: one is who plays, the other is how they play. Most long-range goals come from professionals, but an amateur can score one.

   In the lesson window

   • Think it through: A well-funded criminal group spends a year quietly inside a bank’s systems, moving slowly to avoid notice. Does its campaign count as an APT?

6. 5. APT and unskilled attacker compared Explain 4 min

   Purpose: Contrast the two ends of the range.

   Ask

   • Which row of the table matters most to a defender, and why?

   Responses to expect

   • Stealth, because it decides whether anyone notices.
   • On screen in turns: the opening; then the APT and the unskilled attacker compared; why the table compares a style with an actor type.

7. 6. Living off the land Predict 7 min

   Purpose: Explain living off the land and why it is hard to tell from normal administration.

   Ask

   • How could an intruder leave security software nothing to find?

   Responses to expect

   • Some suggest disabling the software; steer towards using what is already there.
   • On screen in turns: the opening question, its answer; then what living off the land is, and the tools it uses; why living off the land is stealthy; defending against it.

   Misconceptions to challenge

   • A learner may believe: “Advanced means advanced malware.” Respond: A capable intruder may bring almost none.

   If the explanation does not land: A burglar who brings no tools and uses the ladder and keys already in the shed leaves nothing unusual behind for anyone to find.

   To go further

   • What would “normal” use of PowerShell look like in a school, so that unusual use stands out?

   In the lesson window

   • Think it through: Security software is good at spotting known malicious files. How could an intruder avoid giving it anything to find?

8. 7. A real example: Volt Typhoon Explain 7 min

   Purpose: Use a published example to connect state links, internet-facing devices, living off the land and persistence, with the right cautions.

   Ask

   • What does “at least five years” describe?

   Responses to expect

   • Some read it as true of every intrusion; point to “some victim environments”.
   • On screen in turns: the opening; then what the advisory reported, starting with state-linked activity; the way in; living off the land; long-term persistence; a multi-stage intrusion; two cautions that keep the example accurate; the check question on the five-year figure, and its answer; what to take from the example.

   In the lesson window

   • Check your understanding: What does the “at least five years” figure in the advisory describe?

9. 8. MITRE ATT&CK Predict 14 min

   Purpose: Introduce ATT&CK, tactics and techniques, and map a short incident to it.

   Ask

   • What two questions would you ask about every intruder action?
   • Password tried across many accounts: is Credential Access the tactic or the technique?

   Responses to expect

   • Why and how come quickly once learners think of describing actions to a colleague.
   • On screen in turns: the opening; then the question on describing each action, and its answer; tactics, techniques and sub-techniques; three examples from ATT&CK; the fictional incident, with its tactics and techniques held back; the tactic and technique for each action; what the mapping gives the firm; tactic and technique side by side; the check question on password spraying, and its answer; from adversary behaviour to threat knowledge; exploring ATT&CK yourself.

   Misconceptions to challenge

   • A learner may believe: “MITRE ATT&CK is a security tool.” Respond: It is a knowledge base; people and products do the defending.

   Discussion pause: In the fictional mapping, the tactic and technique columns are held back: let pairs map each action before revealing.

   If the explanation does not land: Use a football match: the tactic is to defend a lead; the technique is to put more players behind the ball.

   To go further

   • Pick one technique from the mapping table and look up its mitigations on the ATT&CK site.

   In the lesson window

   • Think it through: If you had to describe each thing an intruder did, so that another defender understood exactly what you meant, what two questions would you ask about every action?
   • Check your understanding: An intruder tries one common password against hundreds of accounts, hoping one works. In ATT&CK terms, is “Credential Access” the tactic or the technique?

10. 9. Security+ terminology Explain 2 min

    Purpose: Map the lesson to the Security+ objectives’ wording.

    Ask

    • Which two terms in this lesson are professional vocabulary rather than exam list items?

    Responses to expect

    • APT and living off the land.
    • On screen in turns: the opening; then APT and living off the land as ordinary vocabulary.

11. 10. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The 3am question tests living off the land; the report wording tests what ATT&CK is for.
    • On screen in turns: the opening question, its answer; then the question on the vague report, and its answer.

    In the lesson window

    • Apply it: A school’s IT team sees the built-in remote-management tool being used at 3am from a teacher’s account. A scan finds no malware. Can they relax?
    • Apply it: An analyst writes in a report: “The attacker did something to stay in.” How would ATT&CK help?

12. 11. Check your understanding Check 9 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The stages question is multiple-select.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; the next group of revision questions, starting with its first; the second revision question; the third revision question; the fourth revision question; where to practise next.

13. 12. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: what does a tactic answer, and what does a technique answer?

    Responses to expect

    • Why the adversary acted; how they did it.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

14. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • States can sustain long, well-funded efforts, and hide behind deniability.
    • APT names a patient, stealthy style; nation-state names who acts.
    • Legitimate tools in the wrong hands leave little for malware scanners to find.
    • Published assessments are reported as assessments, with their limits.
    • ATT&CK gives every adversary action a shared name: its goal and its method.

Consolidation

• States can sustain long, well-funded efforts, and hide behind deniability.
• APT names a patient, stealthy style; nation-state names who acts.
• Legitimate tools in the wrong hands leave little for malware scanners to find.
• Published assessments are reported as assessments, with their limits.
• ATT&CK gives every adversary action a shared name: its goal and its method.