MITRE ATT&CKgroup

G0073 APT19

Published 2018-10-17 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Codoso, C0d0so0, Codoso Team, Sunshop Group
Version
1.6
Created
2018-10-17

Description

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same.

Related

Uses · MITRE ATT&CK (23)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • T1588.002 Tool sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1574.001 DLL sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1218.010 Regsvr32 sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.003 Windows Service sub-technique
  • S0363 Empire software (tool)
  • T1189 Drive-by Compromise technique
  • S0154 Cobalt Strike software (malware)
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1016 System Network Configuration Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1059 Command and Scripting Interpreter technique
  • T1082 System Information Discovery technique
  • T1112 Modify Registry technique

References