Equating "detection of residential proxies" directly with "APT intrusion" is not rigorous; remote work, privacy tools, software testing and even accelerators self-installed by employees can all produce similar traffic characteristics, and judgment requires an evidence chain combining the frequency of proxy connections, destination addresses, data exfiltration volume and whether associated terminals are compromised.