TA459
Linked to China by three sources.
Reports per quarter
Techniques seen in the last two years
- T1003.001 1 report reports only
- T1027 1 report reports only
- T1037 1 report reports only
- T1055 1 report reports only
- T1056.001 1 report reports only
- T1069.002 1 report reports only
- T1071.001 1 report reports only
- T1087.001 1 report reports only
- T1087.002 1 report reports only
- T1095 1 report reports only
Show all 19 techniques Show fewer
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2012-0158 KEV ransomware
- CVE-2017-0199 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
ShadowPad: new activity from the Winnti group
The original link failed its last check. Original publisher Detailsfor ShadowPad: new activity from the Winnti group
-
Above the Fold and in Your Inbox- Tracing State-Aligned Activity Targeting Journalists, Media
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Above the Fold and in Your Inbox- Tracing State-Aligned Activity Targeting Journalists, Media
-
The original link failed its last check. Original publisher Detailsfor Презентация PowerPoint
-
The original link failed its last check. Original publisher Detailsfor winnti-2020-rus.pdf
-
2020.09.29_ShadowPad - new activity from the Winnti group
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2020.09.29_ShadowPad - new activity from the Winnti group
-
APT Targets Financial Analysts with CVE-2017-0199
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor APT Targets Financial Analysts with CVE-2017-0199
-
APT Targets Financial Analysts with CVE-2017-0199
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor APT Targets Financial Analysts with CVE-2017-0199
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor In Pursuit of Optical Fibers and Troop Intel: Targeted Attack Distributes PlugX in Russia | Proofpoint
Show all 12 reports Show fewer
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor In Pursuit of Optical Fibers and Troop Intel_ Targeted Attack Distributes PlugX in Russia _ Proofpoint
Newest first. Details opens the report in Explore.