MITRE ATT&CKgroup
G1023 APT5
- Domain
- enterprise
- Aliases
- Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda, UNC2630
- Version
- 1.1
- Created
- 2024-02-05
Description
APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.
Related
Uses · MITRE ATT&CK (42)
- T1685 Disable or Modify Tools technique
- T1098.007 Additional Local or Domain Groups sub-technique
- S1113 RAPIDPULSE software (malware)
- S1110 SLIGHTPULSE software (malware)
- S1108 PULSECHECK software (malware)
- S1109 PACEMAKER software (malware)
- S1104 SLOWPULSE software (malware)
- T1654 Log Enumeration technique
- S1050 PcShare software (tool)
- T1583.005 Botnet sub-technique
- T1074.001 Local Data Staging sub-technique
- T1078.002 Domain Accounts sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1560.001 Archive via Utility sub-technique
- T1003.001 LSASS Memory sub-technique
- T1003.002 Security Account Manager sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.004 SSH sub-technique
- T1056.001 Keylogging sub-technique
- T1554 Compromise Host Software Binary technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.003 Clear Command History sub-technique
- T1070.004 File Deletion sub-technique
- T1070.006 Timestomp sub-technique
- T1136.001 Local Account sub-technique
- T1505.003 Web Shell sub-technique
- T1053.003 Cron sub-technique
- T1190 Exploit Public-Facing Application technique
Referenced by MITRE ATT&CK · attributed to (1)
- C0052 SPACEHOP Activity campaign
References
- https://web.archive.org/web/20220122121143/https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-southeast-asia-threat-landscape.pdf FireEye Southeast Asia Threat Landscape March 2015
- https://www.mandiant.com/resources/insights/apt-groups Mandiant Advanced Persistent Threats
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW Microsoft East Asia Threats September 2023
- https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF NSA APT5 Citrix Threat Hunting December 2022
- https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day Mandiant Pulse Secure Zero-Day April 2021
- https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices Mandiant Pulse Secure Update May 2021
- https://www.secureworks.com/research/threat-profiles/bronze-fleetwood Secureworks BRONZE FLEETWOOD Profile