APT19
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT19Our name
- Codoso TeamMandiant
- Sunshop GroupMITRE ATT&CK
- C0d0so0Palo Alto Networks
- CodosoPalo Alto Networks
Targets
Sectors: Defence, Energy, Finance, Telecommunications, Education, Manufacturing, Legal, Pharmaceuticals
Source: MITRE ATT&CKKnown techniques
- T1016System Network Configuration Discovery
- T1027.010Command Obfuscation
- T1027.013Encrypted/Encoded File
- T1033System Owner/User Discovery
- T1059Command and Scripting Interpreter
- T1059.001PowerShell
- T1071.001Web Protocols
- T1082System Information Discovery
- T1112Modify Registry
- T1132.001Standard Encoding
- T1140Deobfuscate/Decode Files or Information
- T1189Drive-by Compromise
- T1204.002Malicious File
- T1218.010Regsvr32
- T1218.011Rundll32
- T1543.003Windows Service
- T1547.001Registry Run Keys / Startup Folder
- T1564.003Hidden Window
- T1566.001Spearphishing Attachment
- T1574.001DLL
- T1588.002Tool
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.