[![](https://1.bp.blogspot.com/-b7RCeTOHRks/Wlub4GV1GrI/AAAAAAAArDE/cC06nMrVq8QE6x7btPxx4Qi-v4VNVrqzQCLcBGAs/s320/googlechina.jpg)]() Last week I [Tweeted]() the following on the 8th anniversary of [Google's blog post about its compromise by Chinese threat actors](): _This intrusion made the term APT mainstream. I was the first to associate it with Aurora, in this post _ _ __https://taosecurity.blogspot.com/2010/01/google-v-china.html_ _ __My first APT post was a careful reference in 2007, when we all feared being accused of "leaking classified" re China: _ _ __https://taosecurity.blogspot.com/2007/10/air-force-cyberspace-report.html_ _ _I should have added the term "publicly" to my original Tweet. There were consultants with years of APT experience involved in the Google incident response, and they recognized the work of APT17 at that company and others. Those consultants honored their NDAs and have stayed quiet. I wrote my original Tweet as a reminder that "APT" was not a popular, recognized term until the Google announcement on 12 January 2010. In my [Google v China blog post]() I wrote: _Welcome to the party, Google. You can use the term "advanced persistent threat" (APT) if you want to give this adversary its proper name._ I also [Tweeted]() a similar statement on the same day: _This is horrifying: http://bit.ly/7x7vVW Google admits intellectual property theft from China; it's called Advanced Persistent Threat, GOOG_ I made the explicit link of China and APT because no one had done that publicly. This slide from a [2011 briefing I did in Hawaii]() captures a few historical points: [![](https://1.bp.blogspot.com/-kVom25US1Ws/WlukE7Q9stI/AAAAAAAArDU/PR3HGje_GToutdBYCY-lnRjrnqPZp5M2gCLcBGAs/s640/hawaii.jpg)]() The Google incident was a watershed, for reasons I blogged on [16 January 2010](). I remember the [SANS DFIR 2008 event]() as effectively "APTCon," but beyond Mandiant, Northrup Grumman, and NetWitness, no one was really talking publicly about the APT until after Google. As I noted in the July 2009 blog post, [You Down With APT?]() (ugh): _Aside from Northrup Grumman, Mandiant, and a few vendors (like NetWitness, one of the full capture vendors out there) mentioning APT, there's not much else available. **A Google search for "advanced persistent threat" -netwitness -mandiant -Northrop yields 34 results** _(prior to this blog post). (emphasis added) Today that search yields 244,000 results. I would argue we're "past APT." APT was the buzzword for RSA and other vendor-centric events from, say, 2011-2015, with 2013 being the peak following Mandiant's APT1 report. The threat hasn't disappeared, but it has changed. I wrote my Tweet to mark a milestone and to note that I played a small part in it. All my APT posts here are reachable by this [APT tag](). Also see my 2010 article for Information Security Magazine titled [What APT Is, and What It Isn't](). Copyright 2003-2018 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)

Remembering When APT Became Public