- Category
- State · Attributed to a state or working for one.
- Origin
- India(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2013–2026
- Status
- Active
- ATT&CK
- G0142 · 19 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0280 · confucius
IndiaWhat it is
Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0142
- Other names
- Confucius APT
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIndia
- ThreatActor.info (Malpedia et al.)India · high
Targets
- Countries
- Azerbaijan, Bangladesh, France, India, Indonesia, Iran, Italy, Mongolia, Pakistan, Poland, Russia, Slovakia, Spain, Trinidad and Tobago, Ukraine, United Arab Emirates, United Kingdom, United States
Tools
The tools and malware families the sources tie to it.
- ApacheStealer
- Archelaus Beta
- Confucius
- Cyber Eye RAT
- CyberGate
- Hornbill
- MY24
- Sneepy
- SunBird
- Sunbird
- WarzoneRAT
- remote-access-c3
- sctrls
- sip_telephone
- swissknife2
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th