File · APT17 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
APT17
- Group 8
- AURORA PANDA
- Hidden Lynx
- Tailgater Team
- Dogfish
- BRONZE KEYSTONE
- G0025
- Group 72
state sponsor · ChinaMITRE G0001 ↗
attack rose · 16 techniques across 10 tactics
What changed
ledger · newest first- —todaynew CVE4 new CVEs: CVE-2012-1889, CVE-2012-4792, CVE-2013-3893, CVE-2014-0322
Analyst brief
misp-galaxy + mitre-attackFireEye described APT17 in a 2015 report as: 'APT17, also known as DeputyDog, is a China based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations.'
Observed targets (as stated by the sources)
11 countries · 9 sectorsassessed origin · Chinaobserved targets · 11
countries · 11
- United States
- Netherlands
- Italy
- Japan
- United Kingdom
- Belgium
- Russia
- Indonesia
- Germany
- Switzerland
- China
sectors · 9
- Government
- Private sector
- Civil society
- Defense
- Intelligence
- Technology
- Mining
- Government, Administration
- Justice
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique16 techniques · 10 of 15 tactics
Resource development
3 techniquesInitial access
3 techniquesExecution
1 techniquePrivilege escalation
1 techniqueStealth
1 techniqueDefense impairment
1 techniqueCredential access
1 techniqueLateral movement
2 techniquesCollection
2 techniquesCommand and control
1 technique
select a technique
Arsenal
8 malwareas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
CVEs APT17 is cited as exploiting
none on KEV- CVE-2012-18892026-10-17
“We have also observed them using SQL injection as part of their attacks, and exploits based on CVE-2012-1889 and CVE-2013-3893 .”
cited as exploiting · named nearby · source: blogs.cisco.com ↗ · 2026-10-17
- CVE-2013-38932026-10-17
“We have also observed them using SQL injection as part of their attacks, and exploits based on CVE-2012-1889 and CVE-2013-3893 .”
cited as exploiting · named nearby · source: blogs.cisco.com ↗ · 2026-10-17
- CVE-2012-47922026-10-17
“The group is associated with the initial attack campaigns utilising exploits for the following vulnerabilities CVE-2014-0322 and CVE-2012-4792 .”
cited as exploiting · named nearby · source: blogs.cisco.com ↗ · 2026-10-17
- CVE-2014-03222026-10-17
“The group is associated with the initial attack campaigns utilising exploits for the following vulnerabilities CVE-2014-0322 and CVE-2012-4792 .”
cited as exploiting · named nearby · source: blogs.cisco.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
21 sources- 1.web.archive.org/web/20130924130243/https://www.fireeye.com/blog/techni…
- 2.paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/hidden_lynx…
- 3.cfr.org/interactive/cyber-operations/apt-17
- 4.carbonblack.com/2013/02/08/bit9-and-our-customers-security
- 5.web.archive.org/web/20141016080249/http://www.symantec.com/connect/blo…
- 6.web.archive.org/web/20130920000343/https://www.symantec.com/connect/bl…
- 7.recordedfuture.com/hidden-lynx-analysis
- 8.secureworks.com/research/threat-profiles/bronze-keystone
- 9.attack.mitre.org/groups/G0025
- 10.cfr.org/cyber-operations/axiom
- +11 more in the JSON record
Track APT17 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.