MITRE ATT&CKgroup

G0142 Confucius

Published 2021-12-26 Modified 2026-07-31 Official page ↗
Domain
enterprise, mobile
Aliases
Confucius APT
Version
1.1
Created
2021-12-26

Description

Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.

Related

Uses · MITRE ATT&CK (22)

  • T1680 Local Storage Discovery technique
  • S1082 Sunbird software (malware)
  • S1077 Hornbill software (malware)
  • S0670 WarzoneRAT software (malware)
  • T1583.006 Web Services sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1218.005 Mshta sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1221 Template Injection technique
  • T1203 Exploitation for Client Execution technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1119 Automated Collection technique

References