All actors

APT14

Also reported as QAZTeam, ANCHOR PANDA, ALUMINUM, Anchor Panda, APT 14 and 1 other name. Linked to China by three sources.

Reports
23
Last reported
Known CVEs
9
Origin
China
ID
apt14
Merge evidence
8 alias matches

Reports per quarter

  1. 2013 Q1: 4 reports
  2. 2013 Q2: 4 reports
  3. 2013 Q3: no reports
  4. 2013 Q4: 1 report
  5. 2014 Q1: no reports
  6. 2014 Q2: no reports
  7. 2014 Q3: no reports
  8. 2014 Q4: no reports
  9. 2015 Q1: no reports
  10. 2015 Q2: no reports
  11. 2015 Q3: no reports
  12. 2015 Q4: no reports
  13. 2016 Q1: no reports
  14. 2016 Q2: 5 reports
  15. 2016 Q3: 1 report
  16. 2016 Q4: no reports
  17. 2017 Q1: no reports
  18. 2017 Q2: no reports
  19. 2017 Q3: no reports
  20. 2017 Q4: 1 report
  21. 2018 Q1: no reports
  22. 2018 Q2: no reports
  23. 2018 Q3: no reports
  24. 2018 Q4: no reports
  25. 2019 Q1: no reports
  26. 2019 Q2: no reports
  27. 2019 Q3: no reports
  28. 2019 Q4: no reports
  29. 2020 Q1: 1 report
  30. 2020 Q2: no reports
  31. 2020 Q3: no reports
  32. 2020 Q4: no reports
  33. 2021 Q1: no reports
  34. 2021 Q2: no reports
  35. 2021 Q3: 1 report
  36. 2021 Q4: no reports
  37. 2022 Q1: no reports
  38. 2022 Q2: no reports
  39. 2022 Q3: 1 report
  40. 2022 Q4: no reports
  41. 2023 Q1: no reports
  42. 2023 Q2: no reports
  43. 2023 Q3: no reports
  44. 2023 Q4: no reports
  45. 2024 Q1: no reports
  46. 2024 Q2: no reports
  47. 2024 Q3: no reports
  48. 2024 Q4: no reports
  49. 2025 Q1: no reports
  50. 2025 Q2: 1 report
  51. 2025 Q3: no reports
  52. 2025 Q4: no reports
  53. 2026 Q1: 1 report
  54. 2026 Q2: 2 reports
Dated reports, 2013 Q1 to 2026 Q2.

Techniques seen in the last two years

Show all 17 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it fromORKL

  2. Advanced Persistent Threats (APTs)

    date in the title fromORKL

  3. Advanced Persistent Threats (APTs)

    date in the title fromORKL

  4. Advanced Persistent Threat Groups

    date in the title fromORKL

  5. ICIT-Brief-China-Espionage-Dynasty

    date in the CCS '25 data Debra Obyrne fromORKLCCS '25 data

  6. CVE-2015-2545: overview of current threats - Securelist

    file creation date fromORKL

Show all 23 reports Show fewer
  1. CVE-2015-2545: overview of current threats

    date in the CCS '25 data Kaspersky fromORKLCCS '25 data

  2. CVE-2015-2545- overview of current threats

    date in the title fromORKL

  3. PowerPoint Presentation

    date in the CCS '25 data CrowdStrike fromORKLCCS '25 data

  4. CrowdCasts Monthly: You Have an Adversary Problem

    Malpedia library date fromORKL

  5. Who is Samurai Panda

    date in the title fromORKL

  6. Who is Clever Kitten

    date in the title fromORKL

  7. Whois Numbered Panda

    date in the title fromORKL

  8. Who is Anchor Panda

    date in the title fromORKL

Newest first. Details opens the report in Explore.