CVE Intelligence
Home / Threat actors / Tonto Team

Tonto Team G0131

🔔 Create alert

Also known as: Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

7
associated CVEs
17
Techniques
6
Malware and tools

Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2020-8468 High · 8.8 KEV Trend Micro Multiple Products Content Validation Escape Vulnerability
“Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”
CVE-2019-9489 not published here yet
“Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”
CVE-2019-0803 High · 7.8 KEV Ransomware Microsoft Win32k Privilege Escalation Vulnerability
“Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.”
CVE-2018-8174 High · 7.5 KEV Ransomware Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
“Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”
CVE-2018-0802 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”
CVE-2018-0798 High · 8.8 KEV Microsoft Office Memory Corruption Vulnerability
“Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”
CVE-2017-11882 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”

Techniques by tactic

Initial Access
T1566.001 Spearphishing Attachment
Execution
T1059.001 PowerShellT1059.006 PythonT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1574.001 DLL
Persistence
T1505.003 Web Shell
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Stealth
T1574.001 DLL
Credential Access
T1003 OS Credential DumpingT1056.001 Keylogging
Discovery
T1069.001 Local GroupsT1135 Network Share Discovery
Lateral Movement
T1210 Exploitation of Remote Services
Collection
T1056.001 Keylogging
Command and Control
T1090.002 External ProxyT1105 Ingress Tool Transfer

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.