Many beliefs about advanced persistent threats do not match what government advisories say. APT activity does not always involve custom malware or zero-days, it is not limited to government targets, and standard security controls matter. Here are five myths checked against NIST and CISA sources.
Myth 1: APTs always use custom malware
Fact. CISA's Volt Typhoon advisory says the actor mostly avoids custom malware and uses tools already on the system, such as PowerShell, vssadmin, ntdsutil, wmic and netsh. The advisory calls living off the land a hallmark of the group's activity against critical infrastructure. Activity can look like ordinary administration.
Myth 2: APTs always need zero-days
Fact. The same advisory says entry is gained by exploiting known or zero-day flaws, and it describes one case where an unpatched device with a known CVE was used. The SolarWinds alert also lists password guessing and spraying and poorly secured administrative credentials on external remote access services as initial access methods. Basic hygiene closes real doors.
Myth 3: Only governments are targets
Fact. CISA's SolarWinds alert described compromise of government agencies, critical infrastructure entities and private sector organisations. NIST's own definitions describe adversaries by expertise, resources and persistence, not by victim type.
Myth 4: If we clean the malware, it is over
Fact. The Volt Typhoon advisory says the actor primarily relies on valid credentials for persistence and has kept footholds for at least five years. It advises organisations that detect an intrusion to assume full domain compromise. The SolarWinds alert mentions persistence through added credentials and federation trusts.
Myth 5: Nothing stops a sophisticated attacker
Fact. The advisories recommend plain controls: patching internet-facing systems, phishing-resistant MFA, least privilege, central logging and planning for end of life technology. These do not guarantee safety, but they raise the effort needed and improve your chance of noticing.
Why the myths persist
They make good stories. A mysterious program and a secret exploit are more dramatic than a stale admin account. Also, vendors sell against the dramatic version.
How to use this
When a colleague repeats one of these, ask where the claim comes from. Then point them to the advisory text. Debates go better when the source is on the table.
Caveat
Advisories describe specific activity at a point in time. They are evidence about those actors, not a law of nature. Other actors may behave differently.
Quick check
Does living off the land mean no malware is ever involved?
No. The advisory says the group mostly avoids custom malware, which is not the same as never using any.
Which myth is most dangerous?
Probably the belief that cleaning malware ends the incident, since valid credentials can keep access alive.
Sources
Last reviewed: 19 October 2026.
