The (Nation) State of APTs in 2021

This report provides an executive overview of 2021 APT activity, detailing Iranian (APT35/Charming Kitten) social-engineering and macro-enabled Office campaigns, Russian actors (APT28/APT29) reusing infrastructure, zero-day exploitation and credential-harvesting operations, and Chinese-aligned groups (e.g., UNC215, APT27) using novel delivery methods, false flags, and occasional ransomware and cryptomining—stressing continued evolution in tactics and the ongoing global threat to organizations.