MITRE ATT&CKgroup

G0131 Tonto Team

Published 2021-05-05 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda
Version
1.1
Created
2021-05-05

Description

Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).

Related

Uses · MITRE ATT&CK (21)

  • S0596 ShadowPad software (malware)
  • S0590 NBTscan software (tool)
  • T1090.002 External Proxy sub-technique
  • T1574.001 DLL sub-technique
  • T1069.001 Local Groups sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.006 Python sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1056.001 Keylogging sub-technique
  • T1505.003 Web Shell sub-technique
  • S0349 LaZagne software (tool)
  • S0268 Bisonal software (malware)
  • T1203 Exploitation for Client Execution technique
  • T1210 Exploitation of Remote Services technique
  • T1135 Network Share Discovery technique
  • S0002 Mimikatz software (tool)
  • S0008 gsecdump software (tool)
  • T1003 OS Credential Dumping technique
  • T1068 Exploitation for Privilege Escalation technique
  • T1105 Ingress Tool Transfer technique

References