Introduction
APT21 is a threat actor tracked by MISP Galaxy. Additional information pending cataloguing.
Activities and Tactics
Targeted Sectors: Government, Military
Country of Origin: 🇨🇳 China
Risk Level: High
First Seen: 2014
Last Activity: 2014
Incident Type: Espionage
Suspected Victims: Mongolia, Kazakhstan, Tajikistan, Germany, United Kingdom, India, Kyrgyzstan, South Korea, United States, Chile…
Notable Campaigns
- 2014-08
- 2015-12
- China.
- IT (3%)
- Most recently
- NetTraveler Gets a Makeover for 10th Anniversary
- Spear-Phishing Email Targets Diplomat of Uzbekistan
- Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Uzbekistan in China. A spear-phishing email was sent to a diplomat of the Embassy of Uzbekistan who is likely based in Beijing
- activism (3%)
- airspace (6%)
- financial (3%)
- government (19%)
- health (2%) and press (1%).
- https://unit42.paloaltonetworks.com/nettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan/
- https://www.kaspersky.com/about/press-releases/2014_nettraveler-gets-a-makeover-for-10th-anniversary
- industrial and infrastructure (7%)
- military (9%)
- private (11%)
- research (4%)
- the main focus of interest for cyber-espionage activities revolved around diplomatic (32%)
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.
Malware and Tools
- NetTraveler:
- PlugX:
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
References pending cataloguing.