- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- China
- Motivation
- Information theft and espionage
- Seen
- 2013
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0372 · 1937cn
ChinaWhat it is
1937CN is a Chinese hacking group that has been active since at least 2013. The group is known for targeting Vietnamese organizations, including government agencies, businesses, and media outlets. 1937CN has been linked to a number of high-profile cyberattacks, including the hacking of Vietnam Airlines in 2016 and the defacement of Vietnamese government websites in 2015.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Goblin Panda
- Trend Micro
- Earth Zhulong
- Other names
- China1937CN Team, Conimes, Conimes Team, Cycldek, Goblin Panda, Cycldek, Conimes, Temp.Conimes
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Cambodia, India, Indonesia, Japan, Laos, Malaysia, Myanmar, Philippines, South Korea, Southeast Asia, Thailand, United States, Vietnam
- Sectors
- Defense, Energy, Government, Private Sector
Tools
The tools and malware families the sources tie to it.
- BlueCore
- Cyber Eye RAT
- CyberGate
- Hacking Team UEFI Rootkit
- NewCore RAT
- PlugX
- RedCore
- RoyalRoad RTF Weaponizer
- Sisfader
- UNITEDRAKE
- ZeGhost
- tempfun
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de