- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- China
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2014–2026
- Status
- Active
- ATT&CK
- G0018 · 12 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0164 · admin-338
ChinaWhat it is
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Temper Panda
- MITRE ATT&CK
- G0018
- Other names
- Admin338, Magnesium, Team338, Temper Panda, admin@338
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Hong Kong, United States
- Sectors
- Activists, Civil society, Defense, Finance, Financial, Government, Media, Political party, Private sector, Think Tanks, Trade
Tools
The tools and malware families the sources tie to it.
- BUBBLEWRAP
- Backdoor.Oldrea
- China Chopper
- Cyber Eye RAT
- CyberGate
- LOWBALL
- Net
- Poison Ivy
- PoisonIvy
- Systeminfo
- ipconfig
- jRat
- netstat
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de