APT5

Overview

APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.

Targets

Electronic · Technology · Telecommunications

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190
• Custom malware/implant development — ATT&CK: 8 attributed custom malware families

TTPs — 29 techniques across 10 tactics

Tools & malware (13)

Tasklist · PoisonIvy · RAPIDPULSE · PcShare · Mimikatz · SLOWPULSE · SLIGHTPULSE · Skeleton Key · Net · PACEMAKER · gh0st RAT · PULSECHECK · netstat

Reporting (3)

• Digital threats from East Asia increase in breadth and effectiveness — Microsoft Threat Intelligence
• How Microsoft names threat actors — Microsoft
• APT5: Citrix ADC Threat Hunting Guidance — National Security Agency