Tonto Team
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- Tonto TeamOur name
- CactusPeteKaspersky
- Karma PandaKaspersky
- BRONZE HUNTLEYSecureworks
- Earth AkhlutTrend Micro
Targets
Sectors: Government, Defence, Energy, Healthcare, Finance, Education
Regions: Europe, United States, Taiwan, Japan, South Korea
Source: MITRE ATT&CKKnown techniques
- T1003OS Credential Dumping
- T1056.001Keylogging
- T1059.001PowerShell
- T1059.006Python
- T1068Exploitation for Privilege Escalation
- T1069.001Local Groups
- T1090.002External Proxy
- T1105Ingress Tool Transfer
- T1135Network Share Discovery
- T1203Exploitation for Client Execution
- T1204.002Malicious File
- T1210Exploitation of Remote Services
- T1505.003Web Shell
- T1566.001Spearphishing Attachment
- T1574.001DLL
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.