Home / Threat actors / APT19

APT19 G0073

🔔 Create alert

Also known as: Codoso, C0d0so0, Codoso Team, Sunshop Group

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

25

Techniques

2

Malware and tools

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1588.002 Tool

Initial Access

T1189 Drive-by Compromise T1566.001 Spearphishing Attachment

Execution

T1059 Command and Scripting Interpreter T1059.001 PowerShell T1204.002 Malicious File T1574.001 DLL

Persistence

T1112 Modify Registry T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027.010 Command Obfuscation T1027.013 Encrypted/Encoded File T1140 Deobfuscate/Decode Files or Information T1218.010 Regsvr32 T1218.011 Rundll32 T1564.003 Hidden Window T1574.001 DLL

Defense Impairment

T1112 Modify Registry

Discovery

T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1082 System Information Discovery

Command and Control

T1071.001 Web Protocols T1132.001 Standard Encoding

Malware and tools

Cobalt StrikeMalwareS0154
EmpireToolS0363

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.