- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2011–2022
- Status
- Dormant
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0109 · antlion
ChinaWhat it is
Antlion is a Chinese state-backed advanced persistent threat (APT) group, who has been targeting financial institutions in Taiwan. This persistent campaign has lasted over the course of at least 18 months.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Taiwan
- Sectors
- Financial, Manufacturing
Tools
The tools and malware families the sources tie to it.
- CheckID
- EHAGBPSL
- ENCODE MMC
- JpgRun
- Living off the Land
- NetSessionEnum
- ProcDump
- PsExec
- WinRAR
- Xpack
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de