Actors/Nation-state / APT/Asia

APT5

APTCN · China

AKA UNC2630 · Mulberry Typhoon · Poisoned Flight

Microsoft: MANGANESECrowdStrike: KEYHOLE PANDASecureworks: BRONZE FLEETWOOD

Targets15

Sectors6

Threat types1

GIRs covered0/480

Active since2007

Victimology

Geographic footprint · 15 countries

origin · Chinatargeted countries · 15

OCEANIA · 1

Australia

EUROPE · 9

Belgium · Switzerland · Germany · France · United Kingdom · Ireland · Italy · Norway · Sweden

AMERICAS · 2

Canada · United States

ASIA · 3

Japan · South Korea · Taiwan

Sectors targeted

6 of 40

Government83 actors Defense60 actors Aerospace49 actors Technology51 actors Telecom57 actors Dissidents (as targets)14 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 22 techniques

Resource Development · 1

T1583.005Botnet

Initial Access · 1

T1190Exploit Public-Facing Application

Execution · 3

T1053.003Cron T1059.001PowerShell

Persistence · 1

T1554Compromise Host Software Binary

Credential Access · 2

T1003.001LSASS Memory

Discovery · 4

T1049System Network Connections Discovery

Lateral Movement · 2

T1021.001Remote Desktop Protocol T1021.004SSH

Collection · 1

T1560.001Archive via Utility

Defense Impairment · 1

T1685Disable or Modify Tools

Stealth · 6

T1036.005Match Legitimate Resource Name or Location T1055Process Injection

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

T1059.003

Windows Command Shell

T1003.002

Security Account Manager

T1057

Process Discovery

T1083File and Directory Discovery

T1654Log Enumeration

T1070

Indicator Removal

T1070.004File Deletion

T1078.002Domain Accounts

T1078.004Cloud Accounts