APT19
APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same.
- ATT&CK ID
- G0073
- Origin
- China
- Techniques
- 18
- Tools
- 2
Also tracked as Codoso · C0d0so0 · Codoso Team · Sunshop Group
Techniques
Resource Development
Initial Access
Execution
Command and Scripting InterpreterUser ExecutionHijack Execution Flow
Persistence
Modify RegistryCreate or Modify System ProcessBoot or Logon Autostart Execution
Privilege Escalation
Create or Modify System ProcessBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationDeobfuscate/Decode Files or InformationSystem Binary Proxy ExecutionHide ArtifactsHijack Execution Flow
Defense Impairment
Discovery
System Network Configuration DiscoverySystem Owner/User DiscoverySystem Information Discovery
Command and Control
Application Layer ProtocolData Encoding
Software
Cobalt Strike · Empire