Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT16 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT16

  • SVCMONDR
  • G0023

state sponsor · ChinaMITRE G0023 ↗

APT16 — ATT&CK roseAP

attack rose · 1 techniques across 1 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2015-2545

Analyst brief

misp-galaxy + mitre-attack

Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attacks targeting Japanese and Taiwanese organizations in the high-tech, government services, media and financial services industries. Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability, and the local Windows privilege escalation vulnerability CVE-2015-1701. The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO, or a backdoor that we refer to as ELMER.

Observed targets (as stated by the sources)

2 countries · 1 sectors
JapanTaiwanAssessed origin: China

assessed origin · Chinaobserved targets · 2

countries · 2

  • Japan
  • Taiwan

sectors · 1

  • Private sector

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

1 techniques · 1 of 15 tactics

  1. Resource development

    1 technique

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
ELMERS0064 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to APT16

none on KEV
  1. CVE-2015-25452026-10-17
    1. “including the newly discovered Danti and SVCMONDR groups, were exploiting the CVE-2015-2545 vulnerability”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

    2. “This EPS (98c57aa9c7e3f90c4eb4afeba8128484) is exploit CVE-2015-2545 and contains an encrypted binary starting with “PdPD” (50 64 50 44), the same as seen in the Danti attacks.”

      cited as used in a campaign · named nearby · source: securelist.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

6 sources
  1. 1.fireeye.com/blog/threat-research/2015/12/the_eps_awakens.html
  2. 2.cfr.org/interactive/cyber-operations/apt-16
  3. 3.attack.mitre.org/groups/G0023
  4. 4.mandiant.com/resources/insights/apt-groups
  5. 5.securelist.com/analysis/publications/74828/cve-2015-2545-overview-of-…
  6. 6.web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat…

Track APT16 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.