Skip to content

APT18

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical.

ATT&CK ID: G0026
Techniques: 11
Tools: 5

Also tracked as TG-0416 · Dynamite Panda · Threat Group-0416

Techniques

Initial Access

Valid Accounts External Remote Services

Execution

Scheduled Task/Job Command and Scripting Interpreter

Persistence

Scheduled Task/Job Valid Accounts External Remote Services Boot or Logon Autostart Execution

Privilege Escalation

Scheduled Task/Job Valid Accounts Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Indicator Removal Valid Accounts

Discovery

System Information Discovery File and Directory Discovery

Command and Control

Application Layer Protocol Ingress Tool Transfer

Software

HTTPBrowser · Pisloader · cmd · gh0st RAT · hcdLoader

MITRE ATT&CK All threat actors