The media today is filled with news of two kinds of attacks: ransomware attacks, where there is no doubt what the incursion is all about and what the cyberthief wants, and the low-and-slow advanced persistent threat. These seem like opposite ends of the spectrum, but might ransomware attacks actually be covering the tracks of an APT? What’s occurring on the network while the IT team is trying to recover from a malware breach? Chances are, that malware breach is just a clever diversion.