Guide to Finding the Best APT and Nation-State Threat Intelligence News
Advanced persistent threat actors — the nation-state-sponsored groups that conduct espionage, intellectual property theft, and pre-positioning for destructive attacks — operate at a level of sophistication, patience, and resource availability that most commercial security programs are not designed to detect. Understanding which groups are active, what sectors they are targeting, and what techniques they are using is the foundation of threat-informed defense for any organization that represents a potential APT target.
This guide evaluates the best sources for APT and nation-state threat intelligence on the criteria that determine operational value: attribution accuracy and methodology, TTP documentation depth, sector and geographic targeting coverage, and speed from intrusion observation to published intelligence.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts — distilled for practitioners. 50,000+ subscribers. No noise.
Decryption Digest — Best for Daily APT Campaign Coverage
Decryption Digest covers active nation-state campaigns as a primary editorial focus, with daily coverage of newly disclosed APT operations, TTP evolution across named threat groups, targeting pattern shifts, and the specific detection opportunities that allow security teams to identify APT activity before it results in data exfiltration.
For security teams that need to track APT activity without dedicated CTI analysts reading 10 research reports per week, Decryption Digest provides the curated synthesis. Each APT-related item includes the threat actor attribution (using standard industry naming conventions), the specific ATT&CK techniques observed, the targeted sectors, and the defensive actions that address the campaign.
Coverage spans the major nation-state programs: China-nexus actors (APT41, APT40, Volt Typhoon, Salt Typhoon), Russia-nexus actors (APT28, APT29, Sandworm), North Korea-nexus actors (Lazarus Group, BlueNoroff, Kimsuky), and Iran-nexus actors (MuddyWater, APT34, Charming Kitten). Free daily delivery at decryptiondigest.com/newsletter.
Mandiant Threat Intelligence — Best for Attribution Research
Mandiant (Google Threat Intelligence) is the authoritative source for named APT group attribution. The company's two-decade history of responding to nation-state intrusions provides ground-truth attribution data — actual forensic evidence from compromised environments — that most intelligence vendors cannot replicate from telemetry alone.
Mandiant's publicly available APT profiles at mandiant.com document each group's history, TTPs, targeting patterns, and known malware families with the supporting technical evidence. For security architects who need to understand which threat actors are most likely to target their organization given its sector, geography, and data holdings, the Mandiant APT catalog is the reference standard.
The free public Mandiant blog publishes major campaign disclosures and TTP analyses. The full depth of Mandiant's APT intelligence is available in commercial tiers, but the free content remains valuable for organizations without commercial threat intelligence budgets.
CISA and NSA Joint Advisories — Best for Actionable Government Intelligence
When U.S. government agencies publish joint cybersecurity advisories attributing activity to specific nation-state actors, the intelligence underlying those advisories reflects classified sources that no commercial vendor can access. CISA, NSA, FBI, and international partner joint advisories (often with UK NCSC, Australian ASD, Canadian CCCS) represent the highest-confidence public attribution available.
These advisories typically include the specific TTPs used in the attributed campaign, comprehensive IOC lists built from actual victim environments, and detection guidance validated against real intrusion data. For organizations in critical infrastructure sectors — the primary APT targeting priority — CISA joint advisories are the most operationally relevant public intelligence available.
Subscribe to CISA advisory alerts at cisa.gov. Establish a process to ingest IOCs from joint advisories into your SIEM within four hours of publication. These advisories are rare enough (a few per month) that manual processing is feasible, and the intelligence value is too high to automate without review.
Microsoft MSTIC and Google TAG — Best for Technology Platform Threat Intelligence
Microsoft's Threat Intelligence Center (MSTIC) and Google's Threat Analysis Group (TAG) both publish APT intelligence derived from their unique visibility into email platforms, cloud infrastructure, and operating systems used by billions of people globally. This telemetry provides detection and attribution advantages that traditional security vendors cannot replicate.
Microsoft MSTIC's public blog and the Microsoft Security blog publish campaign disclosures covering APT activity that exploits Microsoft products (Exchange, Teams, Windows, Azure AD). For organizations running Microsoft infrastructure, MSTIC disclosures frequently include detection guidance specifically applicable to Microsoft security products.
Google TAG focuses on APT campaigns that use Google products for targeting (Gmail phishing, YouTube account takeovers) and provides regular updates on campaigns targeting high-risk users (journalists, dissidents, political campaigns). Both MSTIC and TAG blogs are free and publish significant original research.
The bottom line
APT intelligence requires multiple complementary sources: Decryption Digest for daily campaign coverage with defensive action focus, Mandiant for deep attribution research and group profiling, CISA and NSA joint advisories for government-intelligence-informed guidance on active campaigns, and Microsoft MSTIC or Google TAG for platform-specific campaign disclosures. Subscribe to Decryption Digest free at decryptiondigest.com/newsletter to track nation-state campaign activity daily without monitoring dozens of separate research blogs.
Frequently asked questions
How do I know if my organization is an APT target?
APT targeting follows predictable patterns based on sector, data holdings, and geopolitical relevance. Organizations in critical infrastructure (energy, water, telecommunications, defense industrial base), those holding government contract data, pharmaceutical and biotech companies, financial institutions, and organizations with significant intellectual property are consistently high-priority APT targets. Geographic factors also matter: organizations operating in geopolitically significant regions or with significant presence in countries that are primary attribution targets face elevated risk.
What is the difference between APT and ransomware threat actors?
APT actors are typically nation-state-sponsored and motivated by espionage, intellectual property theft, or pre-positioning for destructive attacks. They prioritize stealth and long-term access, often remaining undetected for months or years. Ransomware actors are primarily financially motivated and operate on a detect-and-extort model that requires eventual victim notification. The techniques overlap significantly — many ransomware groups use the same initial access and lateral movement TTPs as APT actors — but objectives, dwell time, and operational security tradecraft differ substantially.
Is APT threat intelligence relevant for small and mid-size organizations?
For most SMBs, APT threat intelligence has limited direct operational relevance compared to commodity threat intelligence focused on ransomware, credential theft, and common CVE exploitation. However, SMBs that are in the supply chain of APT-targeted organizations (contractors to defense primes, IT service providers to critical infrastructure, professional services firms with access to large client data) face targeted APT intrusions specifically because they are softer targets than the intended final victim. If your organization has privileged access to APT-priority targets, you are an APT target.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.