From Anomalies to Dismantling APT Campaigns: The Cyber Incident Response Challenge for Businesses

Webinar Security Talk 02, themed “The Wave of APT Attacks Targeting Financial Institutions and Businesses: Practical Perspectives on Detection, Investigation and Response,” took place on September 30, 2026. Speakers included Nguyễn Duy Bình, Cyber Threat Intelligence Specialist, and Bùi Văn Huy, Cybersecurity Incident Response Specialist, from the Security Operations Center at VNPT Cyber Immunity.

Experts and the moderator join a discussion at Security Talk 02 on detecting, investigating and responding to advanced persistent threat campaigns.

Detecting APTs: Looking Beyond a Single Indicator of Compromise

Opening the program, Nguyễn Duy Bình examined the APT landscape in Vietnam and across Asia, focusing on threat actor groups, their targets and prominent attack trends in 2026.

Nguyễn Duy Bình, Cyber Threat Intelligence Specialist at VNPT Cyber Immunity’s Security Operations Center, discusses the APT threat landscape and approaches to identifying targeted attack campaigns.

The expert emphasized that APT detection cannot rely on a single alert. It requires threat intelligence that brings together three layers of information: indicators of compromise (IoCs), indicators of attack (IoAs), and tactics, techniques and procedures (TTPs).

Correlating this information with logs, malware samples and internal network traffic helps cybersecurity teams understand how attackers operate, identify related campaigns and assess risks to their systems.

From an Anomaly to Dismantling an APT Campaign

Following the threat intelligence session, Bùi Văn Huy shared the process of investigating and responding to an APT campaign from an incident response team’s perspective, particularly when an organization lacks comprehensive threat intelligence.

Bùi Văn Huy, Cybersecurity Incident Response Specialist at VNPT Cyber Immunity’s Security Operations Center, analyzes the process of investigating, tracing and responding to an APT campaign.

The case study outlined a process spanning anomaly detection, evidence collection, campaign identification and impact assessment, followed by containment and mitigation.

The expert also stressed that an investigation must extend beyond the device or account initially compromised. Coordination among IT, business, communications and executive teams is also essential to limiting the incident’s impact on business operations and reputation.

From the Attack Chain to Response Tactics: Early Detection and a Structured Response

In the final session, Bùi Văn Huy shared further practical lessons on modeling attack chains and responding to APT incidents.

Rather than addressing only the immediate signs of compromise, businesses need to reconstruct how an attack unfolded, assess its scope and proactively prevent reintrusion.

The expert highlighted the role of continuous monitoring at the Security Operations Center (SOC), structured incident response procedures and coordination across departments in strengthening proactive defenses against cyber threats.

Strengthening Defenses Against Targeted Threats

As VNPT Group’s cybersecurity brand, VNPT Cyber Immunity provides a comprehensive ecosystem of information security solutions for organizations and businesses. Through Security Talk 02, VCI shared practical perspectives and experience in detecting, investigating and responding to APTs, highlighting the importance of proactive defense capabilities.

The Security Talk webinar series continues to connect the expert community, share cybersecurity knowledge and contribute to a safe and trusted digital environment.