- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, PLA Navy
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2009–2026
- Status
- Active
- ATT&CK
- G0026 · 12 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0041 · apt18
ChinaWhat it is
APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Dynamite Panda
- Government agency
- PLA Navy
- Mandiant
- APT 18
- Microsoft
- Satin Typhoon
- MITRE ATT&CK
- G0026
- PwC
- Red Wraith
- Secureworks
- TG-0416, Threat Group-0416
- Other names
- APT 18, Dynamite Panda, Wekby, COMBINE, Elderwood Group, Scandium, SILVERVIPER, Wekby
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- United States
- Sectors
- Aerospace, Civil society, Construction, Defense, Education, Engineering, Government, Health, Healthcare, High tech, High-Tech, Private sector, Telecommunications, Telecoms, Transportation
Tools
The tools and malware families the sources tie to it.
- 0-day exploits for Flash
- AtNow
- FLASHFLOOD
- Gh0st RAT
- HTTPBrowser
- Hacking Team UEFI Rootkit
- Pisloader
- SPACESHIP
- StickyFingers
- Xploit
- cmd
- gh0st RAT
- hcdLoader
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de