Home / Threat actors / APT5

APT5 G1023

🔔 Create alert

Also known as: Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda, UNC2630

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1

associated CVEs

40

Techniques

13

Malware and tools

APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2022-27518 Critical · 9.8 KEV Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

“SPACEHOP Activity: SPACEHOP Activity has enabled the exploitation of CVE-2022-27518 and CVE-2022-27518 for illegitimate access.”

Techniques by tactic

Resource Development

T1583.005 Botnet

Initial Access

T1078.002 Domain Accounts T1078.004 Cloud Accounts T1190 Exploit Public-Facing Application

Execution

T1053.003 Cron T1059.001 PowerShell T1059.003 Windows Command Shell

Persistence

T1053.003 Cron T1078.002 Domain Accounts T1078.004 Cloud Accounts T1098.007 Additional Local or Domain Groups T1136.001 Local Account T1505.003 Web Shell T1554 Compromise Host Software Binary

Privilege Escalation

T1053.003 Cron T1055 Process Injection T1078.002 Domain Accounts T1078.004 Cloud Accounts T1098.007 Additional Local or Domain Groups

Stealth

T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070 Indicator Removal T1070.003 Clear Command History T1070.004 File Deletion T1070.006 Timestomp T1078.002 Domain Accounts T1078.004 Cloud Accounts

Defense Impairment

T1685 Disable or Modify Tools

Credential Access

T1003.001 LSASS Memory T1003.002 Security Account Manager T1056.001 Keylogging

Discovery

T1049 System Network Connections Discovery T1057 Process Discovery T1083 File and Directory Discovery T1654 Log Enumeration

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.004 SSH

Collection

T1056.001 Keylogging T1074.001 Local Data Staging T1560.001 Archive via Utility

Malware and tools

gh0st RATMalwareS0032
PACEMAKERMalwareS1109
PoisonIvyMalwareS0012
PULSECHECKMalwareS1108
RAPIDPULSEMalwareS1113
Skeleton KeyMalwareS0007
SLIGHTPULSEMalwareS1110
SLOWPULSEMalwareS1104
MimikatzToolS0002
NetToolS0039
netstatToolS0104
PcShareToolS1050
TasklistToolS0057

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.