APT-C-12 is a cyber espionage group targeting nuclear industry and scientific research data.
Analyst brief
APT-C-12 (Sapphire Mushroom, Blue Mushroom, NuclearCrisis) is a cyber espionage group primarily targeting government, military industry, scientific research, and finance sectors in China. The group has been active since 2011, focusing on nuclear industry and scientific research information. Its TTPs include over 60 dedicated plugins for lateral movement and more than 670 malware samples, with over 40 identified C2 domains and IPs. Defenders should enhance internal network monitoring for lateral movement activities and block known C2 indicators.
APT-C-12
Sapphire MushroomBlue MushroomNuclearCrisis
unknown
According to 360 TIC the actor has carried out continuous cyber espionage activities since 2011 on key units and departments of the Chinese government, military industry, scientific research, and finance. The organization focuses on information related to the nuclear industry and scientific research. The targets were mainly concentrated in mainland China...[M]ore than 670 malware samples have been collected from the group, including more than 60 malicious plugins specifically for lateral movement; more than 40 C2 domain names and IPs related to the organization have also been discovered.
target sectors
Private sectorGovernmentMilitaryScientific Research