GINC Technology
GINC-APT-0170 · State

APT19

Also Checkered Typhoon, ATG50, Black Vine, BRONZE FIRESTONE, C0d0so, C0d0so0 and 15 other names.

Category
State · Attributed to a state or working for one.
Origin
China(high confidence)
Motivation
Espionage
Seen
to 2026
Status
Active
ATT&CK
G0073 · 21 techniques
Sources
7 sources carry it
Identifier
GINC-APT-0170 · apt19

What it is

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
DEEP PANDA
Mandiant
TEMP.Avengers
Microsoft
Checkered Typhoon
MITRE ATT&CK
G0073
PwC
Red Gargoyle
Secureworks
BRONZE FIRESTONE, TG-3551
Talos and others
Group 13
Other names
ATG50, Black Vine, C0d0so, C0d0so0, CHLORINE, Codoso, Codoso Team, KungFu Kittens, PinkPanther, Pupa, Shell Crew, Sunshop Group, WebMasters

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
United States
Sectors
Finance, Military, Non-profit organisation, Private sector, Technology

Tools

The tools and malware families the sources tie to it.

  • Bergard Trojan
  • Cobalt Strike
  • Derusbi
  • Empire
  • TXER

Sources