Início / Grupos de ameaça / APT5

APT5 G1023

🔔 Criar alerta

Também conhecido como: Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda, UNC2630

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

1

CVEs associadas

40

Técnicas

13

Malwares e ferramentas

APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2022-27518 Crítica · 9.8 KEV Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

“SPACEHOP Activity: SPACEHOP Activity has enabled the exploitation of CVE-2022-27518 and CVE-2022-27518 for illegitimate access.”

Técnicas por tática

Desenvolvimento de recursos

T1583.005 Botnet

Acesso inicial

T1078.002 Domain Accounts T1078.004 Cloud Accounts T1190 Exploit Public-Facing Application

Execução

T1053.003 Cron T1059.001 PowerShell T1059.003 Windows Command Shell

Persistência

T1053.003 Cron T1078.002 Domain Accounts T1078.004 Cloud Accounts T1098.007 Additional Local or Domain Groups T1136.001 Local Account T1505.003 Web Shell T1554 Compromise Host Software Binary

Escalada de privilégios

T1053.003 Cron T1055 Process Injection T1078.002 Domain Accounts T1078.004 Cloud Accounts T1098.007 Additional Local or Domain Groups

Furtividade

T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070 Indicator Removal T1070.003 Clear Command History T1070.004 File Deletion T1070.006 Timestomp T1078.002 Domain Accounts T1078.004 Cloud Accounts

Comprometimento de defesas

T1685 Disable or Modify Tools

Acesso a credenciais

T1003.001 LSASS Memory T1003.002 Security Account Manager T1056.001 Keylogging

Descoberta

T1049 System Network Connections Discovery T1057 Process Discovery T1083 File and Directory Discovery T1654 Log Enumeration

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.004 SSH

Coleta

T1056.001 Keylogging T1074.001 Local Data Staging T1560.001 Archive via Utility

Malwares e ferramentas

gh0st RATMalwareS0032
PACEMAKERMalwareS1109
PoisonIvyMalwareS0012
PULSECHECKMalwareS1108
RAPIDPULSEMalwareS1113
Skeleton KeyMalwareS0007
SLIGHTPULSEMalwareS1110
SLOWPULSEMalwareS1104
MimikatzFerramentaS0002
NetFerramentaS0039
netstatFerramentaS0104
PcShareFerramentaS1050
TasklistFerramentaS0057

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.