Tonto Team
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).
- ATT&CK ID
- G0131
- Origin
- China
- Techniques
- 14
- Tools
- 6
Also tracked as Earth Akhlut · BRONZE HUNTLEY · CactusPete · Karma Panda
Vulnerabilities it has exploited
- CVE-2017-11882 Microsoft OfficeUnscored · exploited in the wild
- CVE-2018-0798 Microsoft OfficeUnscored · exploited in the wild
- CVE-2018-0802 Microsoft OfficeUnscored · exploited in the wild
- CVE-2018-8174 Microsoft WindowsUnscored · exploited in the wild
- CVE-2019-0803 Microsoft Win32kUnscored · exploited in the wild
- CVE-2019-9489 Unscored
- CVE-2020-8468 Trend Micro Apex One, OfficeScan and Worry-Free Business Security AgentsUnscored · exploited in the wild
Techniques
Initial Access
Execution
Command and Scripting InterpreterExploitation for Client ExecutionUser ExecutionHijack Execution Flow
Persistence
Privilege Escalation
Exploitation for Privilege Escalation
Stealth
Credential Access
OS Credential DumpingInput Capture
Discovery
Permission Groups DiscoveryNetwork Share Discovery
Lateral Movement
Exploitation of Remote Services
Collection
Command and Control
Software
Bisonal · LaZagne · Mimikatz · NBTscan · ShadowPad · gsecdump