- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- China
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2009–2026
- Status
- Active
- ATT&CK
- G0025 · 2 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0023 · apt17
ChinaWhat it is
APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Hidden Lynx, Aurora Panda, Hidden Lynx, Aurora Panda
- Microsoft
- Heart Typhoon, Red Typhoon
- MITRE ATT&CK
- G0025
- Secureworks
- BRONZE KEYSTONE, TG-8153
- Talos and others
- Group 72, Group 8
- Operations
- Operation “SMN”
- Other names
- ATG3, Axiom, Burning Umbrella, Deputy Dog, DeputyDog, Dogfish, HELIUM, KAOS, SportsFans, Tailgater, Tailgater Team
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Australia, Belgium, Canada, China, France, Germany, Hong Kong, India, Indonesia, Italy, Japan, Netherlands, Russia, Singapore, South Korea, Switzerland, Taiwan, Ukraine, United Kingdom, United States
- Sectors
- Civil society, Construction, Defense, Education, Engineering, Financial, Food and Agriculture, Government, Government, Administration, Healthcare, Intelligence, IT, Justice, Media, Mining, Non-profit organizations, Pharmaceutical, Private sector, Retail, Technology
Tools
The tools and malware families the sources tie to it.
- BLACKCOFFEE
- Backdoor.Boda
- Backdoor.Moudoor
- Backdoor.Vasport
- China Chopper
- DestroyRAT
- HiKit
- Joy RAT
- Moudoor
- Naid
- PlugX
- Sakula
- Trojan.Hydraq
- Trojan.Naid
- WEBCnC
- ZxShell
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de