- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2005–2026
- Status
- Active
- ATT&CK
- G0013 · 2 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0171 · apt30
ChinaWhat it is
APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- APT 30, Override Panda, LOTUS PANDA, Override Panda
- Mandiant
- APT 30
- Microsoft
- Raspberry Typhoon
- MITRE ATT&CK
- G0013
- PwC
- Red Salamander
- Secureworks
- BRONZE ELGIN, CTG-5326
- Thales
- ATK1
- Other names
- Billbug, Bronze Geneva, Bronze Sterling, DRAGONFISH, ISTHMUS CASTLE, Lotus BLossom, LotusBlossom, RADIUM, Spring Dragon, ST Group
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- ASEAN, Bhutan, Brunei, Cambodia, Hong Kong, India, Indonesia, Japan, Laos, Malaysia, Myanmar, Nepal, Philippines, Saudi Arabia, Singapore, South Korea, Taiwan, Thailand, United States, Vietnam
- Sectors
- Defense, Government, Government, Administration, Military
Tools
The tools and malware families the sources tie to it.
- BACKSPACE
- China Chopper
- FLASHFLOOD
- NETEAGLE
- SHIPSHAPE
- SPACESHIP
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de