← threatfilter.dev / all groups / Tonto Team

Tonto Team

Also known as: Earth Akhlut · BRONZE HUNTLEY · CactusPete · Karma Panda

Overview

Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).

Targets

Government · Military · Private sector

Regions

Eastern Europe · Japan · South Korea · Taiwan · United States

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1203

TTPs — 15 techniques across 10 tactics

Initial Access

T1566.001 Spearphishing Attachment

Execution

T1059.001 PowerShell
T1059.006 Python
T1203 Exploitation for Client Execution
T1204.002 Malicious File

Persistence

T1505.003 Web Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Stealth

T1574.001 DLL

Collection

T1056.001 Keylogging

Command and Control

T1090.002 External Proxy
T1105 Ingress Tool Transfer

Tools & malware (6)

Mimikatz · Bisonal · ShadowPad · LaZagne · NBTscan · gsecdump

Reporting (3)

Exchange servers under siege from at least 10 APT groups — Faou, M., Tartare, M., Dupuy, T
BRONZE HUNTLEY Threat Profile — Secureworks
Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure — Daniel Lughi, Jaromir Horejsi