Combating Advanced Persistent Threats: How Indian Enterprises Can Detect, Contain, and Recover

• 26 September, 2026
• No Comments

Advanced Persistent Threats (APTs) represent the apex of adversarial sophistication. Unlike opportunistic ransomware campaigns, APTs are goal-driven, patient, and surgical — attackers spend weeks or months inside a network before triggering any visible impact. For Indian enterprises navigating a rapidly evolving threat landscape alongside stricter regulatory obligations under the DPDP Act and CERT-In’s six-hour incident reporting rule, understanding APT tradecraft is no longer optional. It is a baseline competency.

This guide covers how APTs operate, the telltale signs they leave behind, and the operational and technological countermeasures that a mature security programme can deploy — including how platforms like PrahiX Ora enable the speed of detection and response that modern compliance windows demand.

What Makes APTs Different from Commodity Threats

A commodity attacker deploys a phishing kit or buys access on a dark-web marketplace, hits hundreds of targets in parallel, and moves on quickly when defences resist. An APT actor is funded, specialised, and persistent by design. Their campaigns typically follow a well-recognised lifecycle:

• Reconnaissance: Passive and active research on employees, technology stack, supply-chain vendors, and regulatory filings.
• Initial access: Spear-phishing, watering-hole attacks against industry-specific portals, or exploitation of internet-facing systems — often a VPN appliance, mail gateway, or web application.
• Establish foothold: Deployment of lightweight implants designed to blend with legitimate traffic (e.g. HTTPS beaconing over port 443 to plausible cloud services).
• Privilege escalation: Credential harvesting via tools like Mimikatz or Kerberoasting in Active Directory environments.
• Lateral movement: Abusing legitimate admin tools (PsExec, WMI, RDP) to hop across segments — often leaving almost no new binaries on disk.
• Collection and exfiltration: Staged data aggregation, slow-drip exfiltration designed to stay below DLP thresholds.
• Impact (optional): Destruction, ransomware deployment, or sustained espionage — sometimes years after initial compromise.

What makes detection difficult is that each individual step can look entirely legitimate. The malice lives in the sequence and context, not in any single event.

The Indian Enterprise Exposure

India’s position as a hub for financial services, pharmaceuticals, critical infrastructure, and IT outsourcing makes it a high-value target. State-sponsored groups from multiple geographies have shown sustained interest in Indian defence supply-chain vendors, critical infrastructure operators, and large BFSI institutions. Domestically, the expanding digital footprint of mid-market enterprises — many of which moved to cloud-first infrastructure without mature security foundations — creates an attractive attack surface.

The regulatory context amplifies the stakes. Under CERT-In’s 2022 direction, organisations must report cybersecurity incidents within six hours of detection. The DPDP Act 2023 adds data-breach notification obligations with significant financial penalties for non-compliance. A prolonged, undetected APT intrusion can mean months of reportable events that the organisation simply did not know about — dramatically increasing both regulatory liability and reputational damage upon discovery.

Indicators of APT Activity: What to Hunt For

Classic security tools alert on known-bad artefacts — file hashes, signatures, known-malicious IPs. APTs deliberately operate below this threshold by using legitimate binaries (living-off-the-land), rotating infrastructure, and custom implants with no prior detection history. Effective APT detection requires behavioural hunting across multiple data sources:

Network Anomalies

• Unusual outbound HTTPS sessions to newly-registered or low-reputation domains, particularly with regular, automated beaconing intervals (every 5 minutes, every 30 seconds).
• Large DNS queries or tunnelled traffic patterns that suggest DNS-over-HTTPS exfiltration.
• East-west SMB/RPC traffic between systems that have no business reason to communicate.
• Sudden spike in traffic from an internal host at unusual hours — common when attackers operate across time zones.

Endpoint Indicators

• PowerShell or WMI executing from unusual parent processes (e.g. Office applications spawning cmd.exe).
• Service creation or scheduled tasks with random-looking names or unusual execution paths.
• Credential access events: LSASS memory reads, SAM database access, Kerberos ticket anomalies.
• Unusual use of built-in tools: PsExec, certutil, bitsadmin used to download or decode payloads.

Identity and Authentication

• Account logins from geographies where the employee is not located.
• Service accounts performing interactive logins or accessing resources outside their normal scope.
• Password spray patterns — many failed authentications across many accounts at low per-account frequency.
• Dormant accounts suddenly becoming active, particularly those with elevated privileges.

Building a Defence-in-Depth Architecture Against APTs

No single control stops a determined, well-resourced APT actor. Effective defence is layered, assumes that perimeter controls will eventually fail, and focuses on reducing dwell time — the period between initial compromise and detection. The industry median dwell time globally is still measured in weeks; for Indian enterprises it can be longer. Every day of undetected presence is additional liability.

Network Segmentation and Zero Trust Access

Flat networks are an APT’s best friend. Micro-segmentation — enforced via next-generation firewall policies rather than just VLANs — dramatically constrains lateral movement. FortiGate NGFW enables granular east-west policy enforcement with application-layer visibility, allowing security teams to define which internal systems legitimately communicate with each other and block anomalous paths at the firewall level.

Complementing segmentation with Zero Trust Network Access (ZTNA) eliminates the implicit trust that VPNs extend to any device that successfully authenticates. Under ZTNA principles, every access request — even from an internal host — is verified against identity, device posture, and context before a session is established. This removes the value of lateral movement: even if an attacker compromises a workstation, they cannot freely pivot to the finance segment or the production database without re-authenticating through enforced controls.

Email Security

Initial access via spear-phishing remains the dominant APT entry vector. FortiMail’s AI-assisted detection engine evaluates sender reputation, message semantics, attachment behaviour, and URL sandboxing to block sophisticated lures that evade signature-based filters. Importantly, FortiMail integrates with FortiGate and the broader Fortinet Security Fabric, so a malicious URL clicked in an email that bypasses initial filters can still be intercepted at the gateway when the endpoint attempts to reach the C2 infrastructure.

Endpoint Detection and Response (EDR)

Modern EDR tools record process execution trees, file system events, registry changes, and network connections at the endpoint, providing the telemetry needed for behavioural hunting. When integrated with a SIEM, EDR data allows analysts to reconstruct the full attack chain — from the initial Office macro execution through credential theft to the first outbound C2 beacon — as a coherent storyline rather than disconnected alerts.

24/7 Monitoring: The Human Element

Technology detects; people investigate and respond. APT actors are skilled at timing their most suspicious actions during weekends, public holidays, or during major events that distract security teams. A 24/7 Security Operations Centre with trained analysts who understand APT tradecraft is non-negotiable for organisations that are genuinely at risk. Threat hunting — proactive, hypothesis-driven searches through telemetry for evidence of compromise that has not triggered any alert — is a core SOC competency that generic managed services often lack.

PrahiX Ora: Unified SecOps for APT Detection and CERT-In Compliance

For many Indian enterprises, the biggest operational challenge is not the absence of security tools — it is the fragmentation of data and visibility across multiple, siloed platforms. APT detection requires correlating events from firewalls, endpoints, DNS, identity systems, and applications over extended timeframes. That correlation is simply not possible when each tool lives in its own console.

PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner, and we deploy and operate the platform for clients across manufacturing, BFSI, healthcare, and critical infrastructure verticals. Ora integrates four capabilities that are each directly relevant to APT defence:

SIEM: Log Correlation Across the Full Attack Surface

Ora’s SIEM ingests events from firewalls, switches, endpoints, cloud workloads, and identity systems into a unified log pipeline. Correlation rules are mapped to MITRE ATT&CK, so when a sequence of events matches a known APT technique — say, a Kerberoasting pattern followed by lateral movement — the platform flags the storyline as a whole, not merely individual events. Graph-based attack reconstruction visualises how a threat actor moved through the environment, dramatically reducing the investigation time that separates detection from containment. Tiered retention (hot, warm, and cold/archive) ensures that log data is available for retrospective hunting across the timeframes APT investigations demand. This architecture also helps evidence compliance with CERT-In’s direction on 180-day in-country log retention — a requirement that many organisations still struggle to operationalise cost-effectively.

NMS: Network Observability That Closes APT Blind Spots

In multi-vendor environments — a mix of FortiGate firewalls, third-party switches, access points from different vendors, and mixed SD-WAN links — NOC visibility is typically fragmented. Ora’s Network Management System (NMS) provides unified observability across the entire estate using LLDP/CDP topology discovery, network path tracing, and ML-based anomaly detection. For APT defence specifically, the NMS’s ability to baseline normal traffic patterns and surface deviations is directly applicable to detecting command-and-control beaconing and covert exfiltration channels that generate subtle but consistent anomalies in network flow data. Auto-healing policies can isolate affected segments while the SOC investigates, limiting the blast radius of an active intrusion.

Video Surveillance (VMS): Physical and Cyber Under One Pane

APT operations sometimes include a physical dimension — insider threat actors, social engineering of facilities staff, or physical access to network infrastructure. Ora’s video surveillance (VMS) capability manages ONVIF/Hikvision/Dahua-compatible cameras with video analytics from the same operations platform that handles network and security events. For manufacturing plants, retail chains, and multi-site enterprises, this unification means that a security event on the network can be instantly correlated with physical access events at the relevant site — a single operations view that was previously impossible without custom integration work.

SOAR: Making CERT-In’s Six-Hour Window Achievable

CERT-In’s requirement to report cybersecurity incidents within six hours of detection is a significant operational challenge when incident response processes are manual. Ora’s SOAR capability addresses this with pre-built playbooks and automated response actions — including pushing blocklists directly to FortiGate firewalls to block confirmed malicious IPs or domains without waiting for manual firewall rule changes. In an APT investigation, where every minute of C2 connectivity means additional exfiltration, automated containment actions can reduce impact even before a full investigation is complete. Critically, SOAR’s playbooks also help organisations produce the structured incident reports that CERT-In requires, ensuring that the six-hour deadline is consistently met rather than aspirationally targeted.

If your organisation is evaluating unified SecOps platforms or wants to understand how Ora can support your CERT-In compliance posture, speak with the PJ Networks team for a deployment assessment.

Practical Incident Response Steps When APT Compromise Is Suspected

Even with mature preventive controls, some APT campaigns succeed in achieving initial access. The difference between a contained incident and a catastrophic breach often comes down to the speed and quality of the response. Here is a practical checklist for Indian enterprise security teams:

1. Do not alert the attacker prematurely. Rushing to block C2 infrastructure before evidence is collected destroys forensic data and may cause the attacker to activate destructive payloads or wipe tracks. Move deliberately.
2. Isolate, do not shut down. Segment affected systems from the rest of the network at the firewall or switch level. Shutting down endpoints destroys volatile memory that holds critical forensic artefacts — process lists, open network connections, encryption keys.
3. Preserve memory and disk images of affected systems before any remediation. These are your primary evidence sources for both investigation and regulatory reporting.
4. Trace the full attack chain. Do not assume the first compromised system you identify is the only one. APTs establish multiple persistence mechanisms and footholds. A partial remediation that misses a secondary implant will result in re-compromise.
5. Meet the CERT-In reporting window. Begin drafting your CERT-In incident report from the moment of confirmed detection. The six-hour clock is absolute. Have a pre-prepared template that your SOC can populate rapidly.
6. Assess DPDP obligations. If personal data of Indian residents was accessed or exfiltrated, assess your notification obligations under the DPDP Act and engage legal counsel early.
7. Conduct a post-incident review. Map the full attack chain to MITRE ATT&CK, identify which controls failed and at which stage, and feed the findings back into your detection rules and security architecture. The goal is to shift the detection point left — to catch the next campaign earlier in the kill chain.

How PJ Networks Supports APT Defence for Indian Enterprises

PJ Networks delivers managed security services designed specifically for the complexity and regulatory environment of Indian enterprise operations. Our capabilities directly relevant to APT defence include:

• 24/7 NOC/SOC: Around-the-clock monitoring with analysts trained in APT tradecraft, threat hunting, and CERT-In-compliant incident reporting.
• FortiGate NGFW deployment and management: Advanced segmentation, SSL inspection, IPS, and application control tuned for east-west threat detection.
• ZTNA implementation: Eliminating implicit network trust so that lateral movement has no free ride, even post-compromise.
• FortiMail: Blocking spear-phishing at the email layer, integrated with the broader Fortinet Security Fabric.
• PrahiX Ora deployment and operations: Unified SIEM, NMS, video surveillance (VMS), and SOAR for correlated visibility and automated response.
• CERT-In and DPDP compliance support: Helping enterprises build the log retention, incident response, and reporting processes that regulatory obligations require.

APTs are patient. So are we. If your organisation wants to understand its current exposure and build a roadmap toward genuine APT resilience, contact PJ Networks for a security assessment tailored to your industry and threat profile.

The measure of a security programme is not whether it is breached — it is how quickly the breach is detected and how decisively it is contained. That speed is what separates a reportable incident from a catastrophic one.