APT actors have evolved their strategies and are now capable of adapting the dissemination and entrenchment tactics based on the victims’ reaction. RSA will present a case of an APT attack in a military sector targeted by a known APT. RSA will then introduce an IR methodology based on “Actionable IOCs” that has proven useful to accelerate the investigation and containment of the incident.