APT (Advanced Persistent Threat) attacks are months-long, undetected and target-specific campaigns. They are seldom caught by standard EDR/AV scans.
Our detection approach
- Threat hunting — hypothesis-based proactive search
- Anomaly analysis — deviation from a user-behavior baseline
- YARA rules — signature matching against known APT groups
- Memory forensics — persistence techniques living in RAM
- Network forensics — analysis of long-running C2 traffic
APT groups we track
The principal actors targeting Türkiye and our region:
- APT28, APT29 (state-sponsored)
- MuddyWater (defense industry)
- Lazarus (finance)
- Cobalt Group (banking)
- Various ransomware operators (BlackCat, LockBit, Conti variants)
Deliverables
- Compromise assessment report
- Timeline reconstruction
- Adversary group attribution
- Containment and eradication recommendations
