Russia's Apt29 on average is inside a targeted network about one year before being detected.

https://www.thegatewaypundit.com/2023/01/biden-white-house-faa-no-evidence-cyber-attack-cause-not-clear/