For months, a stealthy operator uses custom tools against the county elections office, staying quiet and adapting when a host is rebuilt. Which term correctly labels this campaign?

For months, a stealthy operator uses custom tools against the county elections office, staying quiet and adapting when a host is rebuilt. The correct label is an advanced persistent threat (APT), defined by sophistication plus long-term persistence. Civic framing matters because elections infrastructure is a sensitive municipal target; months of adaptive custom tooling meet the APT criteria in a way a short smash-and-grab does not.

Calling the campaign a smash-and-grab ransomware affiliate that encrypts and leaves in hours fails by concept: that pattern is loud, short-lived extortion, not months of stealthy adaptation. Labeling it a single-source denial-of-service against the voter-information website fails by concept: DoS is an availability flood, which does not describe quiet custom tooling and persistence. Calling it zero trust applied to poll-worker laptops fails by concept: zero trust is a defensive access architecture, not an adversary campaign type.

Exam caveat: SPLK-5001 expects APT only when capability and long-term persistence are both present—do not award the APT label to every civic ransomware hit or availability event.

Operational check: Document dwell time, custom tooling, and rebuild-evasion in the elections case file, retain APT classification when those facts hold, and avoid renaming the campaign as DoS or zero trust in board updates.