APT attackers normally aim to infiltrate an information domain permanently. They have access to the necessary resources and are capable of performing long-term attack campaigns. To this end, they use tools and methods that are tailored to their specific target. Even if an APT incident is detected, it cannot be assumed that all the access routes of the attackers have been found, all infections and malware communication channels have been eliminated, and all backdoors have been removed. If an incomplete cleaning process is conducted, it is very likely that an attacker will regain access to the IT systems and start to broaden their access at a later point in time (e.g. after a longer period of inactivity). This can be done not only by placing backdoors in operating systems and application software, but by manipulating hardware-oriented components like firmware, as well. Such modifications are very hard to identify and very few people have the expertise required to extract and analyse them. If the persons in charge try to clean IT components by overwriting or updating the firmware, for example, the attacker may have also modified the update routines. This provides an opportunity to re-enter the system.