Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT12 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT12

  • NUMBERED PANDA
  • TG-2754
  • BeeBus
  • Group 22
  • DynCalc
  • Calc Team
  • DNSCalc
  • Crimson Iron

state sponsor · ChinaMITRE G0005 ↗

APT12 — ATT&CK roseAP

attack rose · 5 techniques across 3 tactics

What changed

ledger · newest first
  1. —todaynew CVE6 new CVEs: CVE-2009-0927, CVE-2009-3129, CVE-2009-4324, CVE-2011-0609, CVE-2011-0611, CVE-2012-0158

Analyst brief

misp-galaxy + mitre-attack

A group of China-based attackers, who conducted a number of spear phishing attacks in 2013.

Observed targets (as stated by the sources)

2 countries · 2 sectors
TaiwanJapanAssessed origin: China

assessed origin · Chinaobserved targets · 2

countries · 2

  • Taiwan
  • Japan

sectors · 2

  • Private sector
  • Government

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

5 techniques · 3 of 15 tactics

  1. Initial access

    1 technique

  2. Execution

    2 techniques

  3. Command and control

    2 techniques

select a technique

Arsenal

2 malware · 1 tools
Malware
Malware · 2ATT&CK
IxesheS0015 ↗
RIPTIDES0003 ↗
Tools
Tools · 1ATT&CK
HTRANS0040 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs APT12 is cited as exploiting

none on KEV
  1. CVE-2011-06112026-10-17
    1. “vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611)”

      cited as exploiting · named nearby · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2009-09272026-10-17
    1. “vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611)”

      cited as exploiting · named nearby · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2011-06092026-10-17
    1. “vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611)”

      cited as exploiting · named nearby · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2009-43242026-10-17
    1. “vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611)”

      cited as exploiting · named nearby · source: attack.mitre.org ↗ · 2026-10-17

  5. CVE-2012-01582026-10-17
    1. “APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158)”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  6. CVE-2009-31292026-10-17
    1. “APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158)”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2016IXESHE Derivative IHEATE Targets Users in AmericaTrend Micro ↗
  2. 2013Operation BeebusFireEye ↗
  3. 2013The Mutter Backdoor: Operation Beebus with New TargetsFireeye ↗
  4. 2012Ixeshe An Apt CampaignTrend Micro ↗

Take it with you

keyless · no signup

References

6 sources
  1. 1.crowdstrike.com/blog/whois-numbered-panda
  2. 2.cfr.org/interactive/cyber-operations/apt-12
  3. 3.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-grou…
  4. 4.secureworks.com/research/threat-profiles/bronze-globe
  5. 5.mandiant.com/resources/insights/apt-groups
  6. 6.attack.mitre.org/groups/G0005

Track APT12 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.