Home / Threat actors / Confucius
Confucius G0142
Also known as: Confucius APT
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
3
associated CVEs
22
Techniques
1
Malware and tools
Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.”
“Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.”
“Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.”
Techniques by tactic
Resource Development
T1583.006 Web Services Initial Access
T1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link Execution
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious File Persistence
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder Stealth
T1218.005 MshtaT1221 Template Injection Discovery
T1083 File and Directory DiscoveryT1680 Local Storage Discovery Collection
T1119 Automated Collection Command and Control
T1071.001 Web ProtocolsT1105 Ingress Tool Transfer Exfiltration
T1041 Exfiltration Over C2 ChannelT1567.002 Exfiltration to Cloud Storage Malware and tools
- WarzoneRATMalwareS0670
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.