admin@338

Overview

admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors.

Naming & attribution

admin@338 is tracked under 1 names across the industry. It uses 12 documented ATT&CK techniques — more than 35% of the 174 groups tracked here.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Darkhotel South Korea — 8 shared techniques (29% overlap)
• APT1 China — 7 shared techniques (25% overlap)
• Poseidon Group — 4 shared techniques (25% overlap)
• Sowbug — 4 shared techniques (24% overlap)
• SideCopy Pakistan — 5 shared techniques (22% overlap)
• Tropic Trooper China — 9 shared techniques (21% overlap)

Targets

Activists · Civil society · Finance · Government · Political party · Private sector · Trade

Regions

Hong Kong · United States

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 3 attributed custom malware families

TTPs — 12 techniques across 4 tactics

Tools & malware (7)

BUBBLEWRAP · LOWBALL · Systeminfo · PoisonIvy · Net · netstat · ipconfig

Reporting (1)

• China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets — FireEye Threat Intelligence