APT5

Introduction

APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits. NSA APT5 Citrix Threat Hunting December 2022 Microsoft East Asia Threats September 2023 Mandiant Pulse Secure Zero-Day April 2021 Mandiant Pulse Secure Update May 2021 FireEye Southeast Asia Threat Landscape March 2015 Mandiant Advanced Persistent Threats

Activities and Tactics

Targeted Sectors: Electronic, Telecoms, Technology

Country of Origin: 🇨🇳 China

Notable Campaigns

• SPACEHOP Activity (C0052): SPACEHOP Activity is conducted through commercially leased Virtual Private Servers (VPS), otherwise known as provisioned Operational Relay Box (ORB) networks. The network leveraged for SPACEHOP Activity enabled China-nexus cyber threat actors – such as APT5 and Ke3chang – to perform network reconnaissance scanning and vulnerability exploitation. SPACEHOP Activity has historically targeted entities in North America, Europe, and the Middle East.(Citation: ORB Mandiant)

Tactics, Techniques, and Procedures (TTPs)

• T1059.001 PowerShell
• T1136.001 Local Account
• T1070.006 Timestomp
• T1021.001 Remote Desktop Protocol
• T1654 Log Enumeration
• T1685 Disable or Modify Tools
• T1583.005 Botnet
• T1074.001 Local Data Staging
• T1554 Compromise Host Software Binary
• T1056.001 Keylogging
• T1078.004 Cloud Accounts
• T1560.001 Archive via Utility
• T1003.001 LSASS Memory
• T1003.002 Security Account Manager
• T1070.004 File Deletion
• T1098.007 Additional Local or Domain Groups
• T1057 Process Discovery
• T1070 Indicator Removal
• T1053.003 Cron
• T1059.003 Windows Command Shell
• T1021.004 SSH
• T1055 Process Injection
• T1505.003 Web Shell
• T1049 System Network Connections Discovery
• T1078.002 Domain Accounts
• T1036.005 Match Legitimate Resource Name or Location
• T1070.003 Clear Command History
• T1083 File and Directory Discovery
• T1190 Exploit Public-Facing Application

ATT&CK technique IDs (denormalized)

• T1003.001
• T1003.002
• T1021.001
• T1021.004
• T1036.005
• T1049
• T1053.003
• T1055
• T1056.001
• T1057
• T1059.001
• T1059.003
• T1070
• T1070.003
• T1070.004
• T1070.006
• T1074.001
• T1078.002
• T1078.004
• T1083
• T1098.007
• T1136.001
• T1190
• T1505.003
• T1554
• T1560.001
• T1583.005
• T1654
• T1685

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• SHIPSHAPE
• CrossRat
• BRIGHTCREST:
• SWEETCOLA:
• SPIRITBOX:
• PALEJAB:
• WIDERIM:
• WINVAULT:
• HAPPYSAD:
• BIRDWORLD:
• FARCRY:
• CYFREE:
• FULLSILO:
• HELLOTHEWORLD:
• HAZELNUT:
• GIF89A:
• SCREENBIND:
• SHINYFUR:
• TRUCKBED:
• LEOUNCIA:
• FREESWIM:
• PULLTAB:
• HIREDHELP:
• NEDDYHORSE:
• PITCHFORK:
• BRIGHTCOMB:
• ENCORE:

MITRE ATT&CK Software

• Tasklist (S0057) — tool
• PoisonIvy (S0012) — malware
• RAPIDPULSE (S1113) — malware
• PcShare (S1050) — tool
• Mimikatz (S0002) — tool
• SLOWPULSE (S1104) — malware
• SLIGHTPULSE (S1110) — malware
• Skeleton Key (S0007) — malware
• Net (S0039) — tool
• PACEMAKER (S1109) — malware
• gh0st RAT (S0032) — malware
• PULSECHECK (S1108) — malware
• netstat (S0104) — tool

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [7] FireEye Southeast Asia Threat Landscape March 2015 FireEye. (2015, March). SOUTHEAST ASIA: AN EVOLVING CYBER THREAT LANDSCAPE. Retrieved February 5, 2024. [8] Mandiant Advanced Persistent Threats Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024. [9] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [10] Microsoft East Asia Threats September 2023 Microsoft Threat Intelligence. (2023, September). Digital threats from East Asia increase in breadth and effectiveness. Retrieved February 5, 2024. [11] NSA APT5 Citrix Threat Hunting December 2022 National Security Agency. (2022, December). APT5: Citrix ADC Threat Hunting Guidance. Retrieved February 5, 2024. [12] Mandiant Pulse Secure Zero-Day April 2021 Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024. [13] Mandiant Pulse Secure Update May 2021 Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024. [14] Secureworks BRONZE FLEETWOOD Profile Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.