- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, PLA Navy
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2007
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0111 · apt4
ChinaWhat it is
Sodium is reportedly a "sophisticated Chinese state-affiliated" threat actor group, which has especially targeted defense, government, and high-tech organizations in the United States.<sup>[GitHub cybershujin Threat-Actors-use-of-Artifical-Intelligence]</sup>
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Samurai Panda, Maverick Panda
- Government agency
- PLA Navy
- Mandiant
- APT 4
- Microsoft
- Salmon Typhoon
- Secureworks
- TG-0623
- Other names
- APT 4, Maverick Panda, Wisp Team, Bronze Edison, Salmon Typhoo, Sodium, Sykipot, Wisp Team
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Hong Kong, Japan, South Korea, United Kingdom, United States
- Sectors
- Aerospace, Aviation, Defense, Government, Military, Private sector, Telecommunications
Tools
The tools and malware families the sources tie to it.
- China Chopper
- Cyber Eye RAT
- CyberGate
- FormerFirstRAT
- IsSpace
- PlugX
- Poldat
- Sykipot
- UNITEDRAKE
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de