APT Explorer

All actors

APT16

Also reported as SVCMONDR and APT 16. Linked to China by three sources.

Reports
15
Last reported
Known CVEs
6
Techniques in ATT&CK
1
Origin
China
ID
G0023
Sources
ATT&CKMISPETDAMalpedia
Merge evidence
7 alias matches

Reports per quarter

Dated reports, 2015 Q4 to 2026 Q2.

Techniques in ATT&CK

Listed by ATT&CK

No report from the last two years names a technique ID.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. CVE-2015-2545: overview of current threats

    date ORKL added it ORKL

    Archived copy on ORKL Details

  2. Tracking Earth Aughisky’s Malware and Changes

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. The EPS Awakens - Part 2 « Threat Research

    date ORKL added it ORKL

    The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Details

  4. Council on Foreign Relations

    date ORKL added it ORKL

    The original link failed its last check. Original publisher Details

  5. The Rise of Earth Aughisky: Tracking the Campaigns Taidoor Started

    date in the CCS '25 data Kaspersky ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  6. A detailed analysis of ELMER Backdoor used by APT16

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  7. A detailed analysis of ELMER Backdoor used by APT16 – CYBER GEEKS

    date in the CCS '25 data Cyber Geeks ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  8. A detailed analysis of ELMER Backdoor used by APT16 – CYBER GEEKS

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. [CB19] Cyber Threat Landscape in Japan – Revealing Threat in the Shadow by Chi En Shen (Ashley) Oleg Bondarenko

    Malpedia library date ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  10. APT16

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

Show all 15 reports Show fewer

  1. CVE-2015-2545: overview of current threats - Securelist

    file creation date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  2. CVE-2015-2545: overview of current threats

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. CVE-2015-2545: overview of current threats

    date in the CCS '25 data Kaspersky ORKLCCS '25 data

    The link to Mirror on Box failed its last check. Mirror on Box Details

  4. CVE-2015-2545- overview of current threats

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  5. The EPS Awakens - Part 2 « Threat Research | FireEye Inc

    date in the CCS '25 data FireEye ORKLCCS '25 data

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

Newest first. Details opens the report in Explore.