China-nexus cyber espionage group targeting high-tech and government sectors in Japan and Taiwan.
Analyst brief
APT16 (tracked as SVCMONDR, G0023) is a China-nexus nation-state cyber espionage group targeting entities in Japan and Taiwan, primarily within high-tech, government services, media, and financial services sectors. The group employs spear-phishing campaigns delivering malicious Microsoft Word documents that exploit vulnerabilities like CVE-2015-1701 for local privilege escalation, deploying malware such as the ELMER backdoor or IRONHALO downloader. Defenders should focus on email security controls against weaponized Office documents, enforce strict patch management for known privilege escalation flaws, and monitor for resource-development TTPs like T1584.004 (Server acquisition) to disrupt C2 infrastructure preparation.
APT16
SVCMONDRG0023
nation-state
Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attacks targeting Japanese and Taiwanese organizations in the high-tech, government services, media and financial services industries. Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability, and the local Windows privilege escalation vulnerability CVE-2015-1701. The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO, or a backdoor that we refer to as ELMER.
origin (suspected)
🇨🇳China· state-sponsoredattribution confidence: medium (50)
Monitor network traffic and system logs to detect creation or leasing of Server infrastructure.
FAQ2
Which specific vulnerabilities does APT16 exploit to gain access to target systems?+
The APT16 group exploits the EPS dict copy use-after-free vulnerability in Microsoft Word documents for initial access, followed by the CVE-2015-1701 privilege escalation vulnerability.
Which countries are targeted by APT16's spear-phishing campaigns?+
APT16 primarily targets organizations in Japan and Taiwan.