APT17

🔴 High
Also known as: APT17, ATG3, AURORA PANDA, Aurora Panda, Axiom, BRONZE KEYSTONE, Burning Umbrella, Deputy Dog, DeputyDog, Dogfish, G0001, G0025, Group 72, Group 8, HELIUM, Heart Typhoon, Hidden Lynx, KAOS, Operation “SMN”, Red Typhoon, SportsFans, TG-8153, Tailgater, Tailgater Team

APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. FireEye APT17

🌍 Country China
📅 Activity 2013 — 2018
⚡ Risk Level High
🎯 Incident Type Espionage
🧭 ATT&CK G0025
Defense Intelligence Technology Mining Government, Administration Justice Government Private sector Civil society
2013
2018

Targeted Victims

United States Netherlands Italy Japan United Kingdom Belgium Russia Indonesia Germany Switzerland China

Associated Operations

000 machines had downloaded a malicious payload. These payloads were being delivered to unsuspecting victims from legitimate websites that were strategically compromised. 2012-06 2012-07 Breach of the Bit9 website Ephemeral Hydra The VOHO campaign VOHO campaign first publicized by RSA https://blog.bit9.com/2013/02/08/bit9-and-our-customers-security/ https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/hidden_lynx.pdf is one of the largest and most successful watering-hole attacks to date. The campaign combined both regional and industry-specific attacks and predominantly targeted organizations that operate in the United States. In a rapidly spreading two-phase attack nearly 4 which started on June 25 and finished July 18

Introduction

APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. FireEye APT17

Activities and Tactics

Targeted Sectors: Defense, Intelligence, Technology, Mining, Government, Administration, Justice, Government, Private sector, Civil society

Country of Origin: 🇨🇳 China

Risk Level: High

First Seen: 2013

Last Activity: 2018

Incident Type: Espionage

Suspected Victims: United States, Netherlands, Italy, Japan, United Kingdom, Belgium, Russia, Indonesia, Germany, Switzerland…

Notable Campaigns

  • 000 machines had downloaded a malicious payload. These payloads were being delivered to unsuspecting victims from legitimate websites that were strategically compromised.
  • 2012-06
  • 2012-07
  • Breach of the Bit9 website
  • Ephemeral Hydra
  • The VOHO campaign
  • VOHO campaign
  • first publicized by RSA
  • https://blog.bit9.com/2013/02/08/bit9-and-our-customers-security/
  • https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/hidden_lynx.pdf
  • is one of the largest and most successful watering-hole attacks to date. The campaign combined both regional and industry-specific attacks and predominantly targeted organizations that operate in the United States. In a rapidly spreading two-phase attack
  • nearly 4
  • which started on June 25 and finished July 18

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 4 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • China Chopper
  • BLACKCOFFEE:
  • WEBCnC:
  • Joy RAT:
  • PlugX:
  • Trojan.Naid:
  • Backdoor.Moudoor:
  • Backdoor.Vasport:
  • Backdoor.Boda:
  • Trojan.Hydraq:
  • ZxShell:
  • Sakula:
  • China Chopper:
  • DestroyRAT:
  • HiKit:
  • Moudoor:
  • Naid:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [4] FireEye APT17 FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024.