Actors/Nation-state / APT/Asia

APT18

G0026APTCN · China

AKA Wekby · Threat Group-0416 · Wekby Group

Microsoft: SCANDIUMCrowdStrike: DYNAMITE PANDASecureworks: TG-0416MITRE: G0026

Targets16

Sectors9

Threat types1

GIRs covered0/480

Active since2009

Also tracked as

5 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

DYNAMITE PANDA

Mandiant

APT18

Microsoft

SCANDIUM

MITRE

G0026

Secureworks

TG-0416

UNATTRIBUTED ALIASESWekbyThreat Group-0416Wekby Group

Victimology

Geographic footprint · 16 countries

origin · Chinatargeted countries · 16

ASIA · 4

Bangladesh · China · Israel · India

AMERICAS · 2

Canada · United States

EUROPE · 10

Switzerland · Germany · Denmark · France · United Kingdom · Italy · Netherlands · Norway · Romania · Sweden

Sectors targeted

9 of 40

Government100 actors Defense72 actors Aerospace59 actors Financial Services74 actors Healthcare47 actors Pharmaceutical27 actors NGOs & Dissidents56 actors Chemicals20 actors Private Sector (generic)29 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 9 techniques

Execution · 2

T1053.002At T1059.003Windows Command Shell

Persistence · 1

Discovery · 1

T1083File and Directory Discovery

Command And Control · 3

T1071.001Web Protocols T1071.004DNS

Stealth · 2

T1070.004File Deletion T1078Valid Accounts

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer9 techniques · layer format 4.5

Related actors

By origin and actor type

T1547.001

Registry Run Keys / Startup Folder

T1105

Ingress Tool Transfer