Home / Threat actors / admin@338
admin@338 G0018
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
1
associated CVEs
12
Techniques
7
Malware and tools
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.”
Techniques by tactic
Initial Access
T1566.001 Spearphishing Attachment Execution
T1059.003 Windows Command ShellT1203 Exploitation for Client ExecutionT1204.002 Malicious File Stealth
T1036.005 Match Legitimate Resource Name or Location Discovery
T1007 System Service DiscoveryT1016 System Network Configuration DiscoveryT1049 System Network Connections DiscoveryT1069.001 Local GroupsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.001 Local Account Malware and tools
- BUBBLEWRAPMalwareS0043
- LOWBALLMalwareS0042
- PoisonIvyMalwareS0012
- ipconfigToolS0100
- NetToolS0039
- netstatToolS0104
- SysteminfoToolS0096
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.