For months, a stealthy operator uses custom tools against the county elections office, staying quiet and adapting when a host is rebuilt. Which term correctly labels this campaign?

An advanced persistent threat is defined by sophistication plus persistence over time, which matches a months-long, stealthy elections-office campaign that uses custom tools and survives host rebuilds. A smash-and-grab ransomware affiliate is typically short-lived and noisy. DoS is an availability flood, and zero trust is a defensive model, not an attacker class. Civic analysts should reserve APT for that durable, capable pattern so elections-incident reporting and intel sharing stay accurate.