APT18

🔴 High
Also known as: APT 18, APT18, COMBINE, DYNAMITE PANDA, Dynamite Panda, Elderwood Group, G0026, PLA Navy, Red Wraith, SCANDIUM, SILVERVIPER, Satin Typhoon, Scandium, TG-0416, Threat Group-0416, Wekby

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. Dell Lateral Movement

🌍 Country China
📅 Activity 2016 — 2016
⚡ Risk Level High
🎯 Incident Type Espionage
🧭 ATT&CK G0026
Aerospace Defense Health High tech Telecoms Government Private sector Civil society
2016
2016

Targeted Victims

United States

Associated Operations

2014-04 2015-06 2016-05 Attacks using DNS Requests as Command and Control Mechanism Community Health Systems data breach Method: Phishing with Pisloader dropper. Method: Phishing with obfuscated variants of the HTTPBrowser tool. Target: Organizations in the USA. https://threatpost.com/apt-gang-branches-out-to-medical-espionage-in-community-health-breach/107828/ https://unit42.paloaltonetworks.com/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/ https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html https://www.venafi.com/blog/infographic-how-an-attack-by-a-cyber-espionage-operator-bypassed-security-controls

Introduction

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. Dell Lateral Movement

Activities and Tactics

Targeted Sectors: Aerospace, Defense, Health, High tech, Telecoms, Government, Private sector, Civil society

Country of Origin: 🇨🇳 China

Risk Level: High

First Seen: 2016

Last Activity: 2016

Incident Type: Espionage

Suspected Victims: United States

Notable Campaigns

  • 2014-04
  • 2015-06
  • 2016-05
  • Attacks using DNS Requests as Command and Control Mechanism
  • Community Health Systems data breach
  • Method: Phishing with Pisloader dropper.
  • Method: Phishing with obfuscated variants of the HTTPBrowser tool.
  • Target: Organizations in the USA.
  • https://threatpost.com/apt-gang-branches-out-to-medical-espionage-in-community-health-breach/107828/
  • https://unit42.paloaltonetworks.com/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/
  • https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop
  • https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html
  • https://www.venafi.com/blog/infographic-how-an-attack-by-a-cyber-espionage-operator-bypassed-security-controls

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • SPACESHIP
  • Hacking Team UEFI Rootkit
  • FLASHFLOOD
  • Xploit
  • 0-day exploits for Flash:
  • AtNow:
  • Gh0st RAT:
  • HTTPBrowser:
  • Pisloader:
  • StickyFingers:
  • hcdLoader:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [6] Dell Lateral Movement Carvey, H.. (2014, September 2). Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems. Retrieved January 25, 2016. [7] Anomali Evasive Maneuvers July 2015 Shelmire, A. (2015, July 06). Evasive Maneuvers by the Wekby group with custom ROP-packing and DNS covert channels. Retrieved November 15, 2018. [8] ThreatStream Evasion Analysis Shelmire, A.. (2015, July 6). Evasive Maneuvers. Retrieved January 22, 2016.