APT30 — ATT&CK profile, 2 techniques

Overview

APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.

Naming & attribution

APT30 is tracked under 1 names across the industry. It uses 2 documented ATT&CK techniques — more than 5% of the 174 groups tracked here.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
APT30	FireEye Labs

Targets

Government

Regions

India · Malaysia · Saudi Arabia · South Korea · Thailand · United States · Vietnam

Capabilities

Custom malware/implant development — ATT&CK: 5 attributed custom malware families

TTPs — 2 techniques across 2 tactics

Initial Access

T1566.001 Spearphishing Attachment

Execution

T1204.002 Malicious File

Tools & malware (5)

SHIPSHAPE · BACKSPACE · FLASHFLOOD · NETEAGLE · SPACESHIP

Reporting (2)

The Naikon APT — Baumgartner, K., Golovkin, M.
APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION — FireEye Labs