Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT18 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT18

  • DYNAMITE PANDA
  • TG-0416
  • SCANDIUM
  • PLA Navy
  • Wekby
  • G0026
  • Satin Typhoon
  • Dynamite Panda

state sponsor · ChinaMITRE G0026 ↗

APT18 — ATT&CK roseAP

attack rose · 12 techniques across 5 tactics

Analyst brief

misp-galaxy + mitre-attack

Wekby was described by Palo Alto Networks in a 2015 report as: 'Wekby is a group that has been active for a number of years, targeting various industries such as healthcare, telecommunications, aerospace, defense, and high tech. The group is known to leverage recently released exploits very shortly after those exploits are available, such as in the case of HackingTeams Flash zero - day exploit.'

Observed targets (as stated by the sources)

1 countries · 8 sectors
United StatesAssessed origin: China

assessed origin · Chinaobserved targets · 1

countries · 1

  • United States

sectors · 8

  • Government
  • Private sector
  • Civil society
  • Aerospace
  • Defense
  • Health
  • High tech
  • Telecoms

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

12 techniques · 5 of 15 tactics

  1. Execution

    2 techniques

  2. Persistence

    2 techniques

  3. Stealth

    3 techniques

  4. Discovery

    2 techniques

  5. Command and control

    3 techniques

select a technique

Arsenal

4 malware · 1 tools
Malware
Malware · 4ATT&CK
hcdLoaderS0071 ↗
gh0st RATS0032 ↗
PisloaderS0124 ↗
HTTPBrowserS0070 ↗
Tools
Tools · 1ATT&CK
cmdS0106 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2016New Wekby Attacks Use DNS Requests As Command and Control MechanismPalo Alto ↗

Take it with you

keyless · no signup

References

7 sources
  1. 1.threatpost.com/apt-gang-branches-out-to-medical-espionage-in-communit…
  2. 2.cfr.org/interactive/cyber-operations/apt-18
  3. 3.attack.mitre.org/groups/G0026
  4. 4.mandiant.com/resources/insights/apt-groups
  5. 5.secureworks.com/resources/blog/where-you-at-indicators-of-lateral-move…
  6. 6.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-eva…
  7. 7.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-eva…

Track APT18 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.