MITRE ATT&CKcampaign

C0052 SPACEHOP Activity

Published 2025-03-25 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2025-03-25

Description

SPACEHOP Activity is conducted through commercially leased Virtual Private Servers (VPS), otherwise known as provisioned Operational Relay Box (ORB) networks. The network leveraged for SPACEHOP Activity enabled China-nexus cyber threat actors – such as APT5 and Ke3chang – to perform network reconnaissance scanning and vulnerability exploitation. SPACEHOP Activity has historically targeted entities in North America, Europe, and the Middle East.

Related

Attributed to · MITRE ATT&CK (2)

Uses · MITRE ATT&CK (4)

  • T1583.003 Virtual Private Server sub-technique
  • T1588.002 Tool sub-technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1190 Exploit Public-Facing Application technique

References