APT5
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT5Our name
- Keyhole PandaMicrosoft
- MANGANESEMicrosoft
- Mulberry TyphoonMicrosoft
- UNC2630MITRE ATT&CK
- BRONZE FLEETWOODSecureworks
Targets
Sectors: Defence, Telecommunications, Aerospace
Regions: Europe
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1003.002Security Account Manager
- T1021.001Remote Desktop Protocol
- T1021.004SSH
- T1036.005Match Legitimate Resource Name or Location
- T1049System Network Connections Discovery
- T1053.003Cron
- T1055Process Injection
- T1056.001Keylogging
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1070Indicator Removal
- T1070.003Clear Command History
- T1070.004File Deletion
- T1070.006Timestomp
- T1074.001Local Data Staging
- T1078.002Domain Accounts
- T1078.004Cloud Accounts
- T1083File and Directory Discovery
- T1098.007Additional Local or Domain Groups
- T1136.001Local Account
- T1190Exploit Public-Facing Application
- T1505.003Web Shell
- T1554Compromise Host Software Binary
- T1560.001Archive via Utility
- T1583.005Botnet
- T1654Log Enumeration
- T1685Disable or Modify Tools
Malware and tools used
gh0st RATMimikatzNetnetstatPACEMAKERPcSharePoisonIvyPULSECHECKRAPIDPULSESkeleton KeySLIGHTPULSESLOWPULSETasklist
Source: MITRE ATT&CKRecent news
No stories yet.