APT19

Overview

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same.

Targets

Finance · Military · Non-profit Organisation · Private sector · Technology

Regions

United States

TTPs — 21 techniques across 8 tactics

Tools & malware (2)

Cobalt Strike · Empire

Reporting (3)

• Privileges and Credentials: Phished at the Request of Counsel — Ahl, I
• ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts — Scott, J. and Spaniel, D
• New Attacks Linked to C0d0so0 Group — Grunzweig, J., Lee, B