Tonto Team G0131

Também conhecido como: Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

CVEs associadas

Técnicas

Malwares e ferramentas

Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2020-8468 Alta · 8.8 KEV Trend Micro Multiple Products Content Validation Escape Vulnerability

“Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”

CVE-2019-9489 ainda não publicada aqui

CVE-2019-0803 Alta · 7.8 KEV Ransomware Microsoft Win32k Privilege Escalation Vulnerability

“Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.”

CVE-2018-8174 Alta · 7.5 KEV Ransomware Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability

CVE-2018-0802 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability

CVE-2018-0798 Alta · 8.8 KEV Microsoft Office Memory Corruption Vulnerability

CVE-2017-11882 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability