APT17

G0025 China Espionage MITRE ATT&CK →

Also known as: Deputy Dog

Overview

APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations.

Naming & attribution

APT17 is tracked under 2 names across the industry. It uses 2 documented ATT&CK techniques — more than 5% of the 174 groups tracked here.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Deputy Dog	FireEye Labs/FireEye Threat Intelligence
APT17	FireEye Labs/FireEye Threat Intelligence

Targets

Civil society · Defense · Government · Intelligence · Justice · Mining · Private sector · Technology

Regions

Belgium · China · Germany · Indonesia · Italy · Japan · Netherlands · Russia · Switzerland · United Kingdom · United States

TTPs — 2 techniques across 1 tactics

Resource Development

T1583.006 Web Services
T1585 Establish Accounts

Tools & malware (1)

BLACKCOFFEE

Reporting (1)

Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic — FireEye Labs/FireEye Threat Intelligence