Introduction
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017). Kaspersky CactusPete Aug 2020 ESET Exchange Mar 2021 FireEye Chinese Espionage October 2019 ARS Technica China Hack SK April 2017 Trend Micro HeartBeat Campaign January 2013 Talos Bisonal 10 Years March 2020
Activities and Tactics
Targeted Sectors: Military, Government, Private sector
Country of Origin: 🇨🇳 China
Risk Level: High
First Seen: 2012
Last Activity: 2012
Suspected Victims: Eastern Europe, Japan, South Korea, Taiwan, United States
Notable Campaigns
- 2009-11
- 2017-02
- 2019 Late
- 2019-03
- 2019-12
- 2020
- 2021-03
- 2022-06
- 2023-04
- At the end of 2019 the group seemed to shift towards a heavier focus on Mongolian and Russian organizations.
- CactusPete APT group’s updated Bisonal backdoor
- Exchange servers under siege from at least 10 APT groups
- FireEye’s director of cyber-espionage analysis John Hultquist told the Wall Street Journal that FireEye had detected a surge in attacks against South Korean targets from China since February
- Government
- In this campaign
- Multi-year Chinese APT Campaign Targets South Korean Academic
- Nice Try Tonto Team
- Operation “Bitter Biscuit”
- Seven Pointed Dagger
- The backdoor was used to target financial and military organizations in Eastern Europe
- Tonto Team Using Anti-Malware Related Files for DLL Side-Loading
- and Political Entities
- https://arstechnica.com/information-technology/2017/04/researchers-claim-china-trying-to-hack-south-korea-missile-defense-efforts/
- https://asec.ahnlab.com/1078
- https://asec.ahnlab.com/en/51746/
- https://go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf
- https://securelist.com/apt-trends-report-q1-2020/96826/
- https://securelist.com/apt-trends-report-q2-2020/97937/
- https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/
- https://www.group-ib.com/blog/tonto-team/
- https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/
- the CactusPete threat actor used a new method to drop an updated version of the DoubleT backdoor onto the computers.
- when South Korea announced it would deploy THAAD in response to North Korean missile tests.
Tactics, Techniques, and Procedures (TTPs)
- T1135 Network Share Discovery
- T1574.001 DLL
- T1090.002 External Proxy
- T1059.006 Python
- T1069.001 Local Groups
- T1056.001 Keylogging
- T1003 OS Credential Dumping
- T1505.003 Web Shell
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1566.001 Spearphishing Attachment
- T1210 Exploitation of Remote Services
- T1059.001 PowerShell
- T1068 Exploitation for Privilege Escalation
- T1105 Ingress Tool Transfer
ATT&CK technique IDs (denormalized)
- T1003
- T1056.001
- T1059.001
- T1059.006
- T1068
- T1069.001
- T1090.002
- T1105
- T1135
- T1203
- T1204.002
- T1210
- T1505.003
- T1566.001
- T1574.001
Notable Indicators of Compromise (IOCs)
No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.
Malware and Tools
- RoyalRoad RTF Weaponizer:
- 8.t Dropper:
- Bioazih:
- Bisonal:
- Dexbia:
- DoubleT:
- Flapjack:
- Living off the Land:
- Mimikatz:
- ShadowPad Winnti:
MITRE ATT&CK Software
- Mimikatz (S0002) — tool
- Bisonal (S0268) — malware
- ShadowPad (S0596) — malware
- LaZagne (S0349) — tool
- NBTscan (S0590) — tool
- gsecdump (S0008) — tool
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
[1] mitre-attack [7] TrendMicro Tonto Team October 2020 Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021. [8] CrowdStrike Manufacturing Threat July 2020 Falcon OverWatch Team. (2020, July 14). Manufacturing Industry in the Adversaries’ Crosshairs. Retrieved October 17, 2021. [9] ESET Exchange Mar 2021 Faou, M., Tartare, M., Dupuy, T. (2021, March 10). Exchange servers under siege from at least 10 APT groups. Retrieved May 21, 2021. [10] Talos Bisonal Mar 2020 Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022. [11] FireEye Chinese Espionage October 2019 Nalani Fraser, Kelli Vanderlee. (2019, October 10). Achievement Unlocked - Chinese Cyber Espionage Evolves to Support Higher Level Missions. Retrieved November 17, 2024. [12] Trend Micro HeartBeat Campaign January 2013 Roland Dela Paz. (2003, January 3). The HeartBeat APT Campaign. Retrieved October 17, 2021. [13] ARS Technica China Hack SK April 2017 Sean Gallagher. (2017, April 21). Researchers claim China trying to hack South Korea missile defense efforts. Retrieved October 17, 2021. [14] Secureworks BRONZE HUNTLEY Secureworks. (2021, January 1). BRONZE HUNTLEY Threat Profile. Retrieved May 5, 2021. [15] Kaspersky CactusPete Aug 2020 Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021. [11] Trend Micro HeartBeat Campaign January 2013