Home / Threat actors / APT18
APT18 G0026
Also known as: TG-0416, Dynamite Panda, Threat Group-0416
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
19
Techniques
5
Malware and tools
APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Initial Access
T1078 Valid AccountsT1133 External Remote Services Execution
T1053.002 AtT1059.003 Windows Command Shell Persistence
T1053.002 AtT1078 Valid AccountsT1133 External Remote ServicesT1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1053.002 AtT1078 Valid AccountsT1547.001 Registry Run Keys / Startup Folder Stealth
T1027.013 Encrypted/Encoded FileT1070.004 File DeletionT1078 Valid Accounts Discovery
T1082 System Information DiscoveryT1083 File and Directory Discovery Command and Control
T1071.001 Web ProtocolsT1071.004 DNST1105 Ingress Tool Transfer Malware and tools
- gh0st RATMalwareS0032
- hcdLoaderMalwareS0071
- HTTPBrowserMalwareS0070
- PisloaderMalwareS0124
- cmdToolS0106
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.