baku

APT18· China

APT18

DYNAMITE PANDATG-0416SCANDIUM

nation-state

Wekby was described by Palo Alto Networks in a 2015 report as: 'Wekby is a group that has been active for a number of years, targeting various industries such as healthcare, telecommunications, aerospace, defense, and high tech. The group is known to leverage recently released exploits very shortly after those exploits are available, such as in the case of HackingTeams Flash zero - day exploit.'

origin (suspected)

China· state-sponsoredattribution confidence: medium (50)

target countries (as stated by the source)

United States

target sectors

GovernmentPrivate sectorCivil societyAerospace

techniques · ATT&CK

At Windows Command Shell External Remote Services Registry Run Keys / Startup Folder Encrypted/Encoded File Valid Accounts System Information Discovery File and Directory Discovery+2

malware

hcdLoader gh0st RAT Pisloader HTTPBrowser cmd

source: misp-galaxy + mitre-attackG0026 7 refs →

FAQ2

Which sectors does APT18 target?

APT18 targets the US defense, aerospace, healthcare, and telecom sectors.

What should defenders focus on regarding APT18?

Defenders should focus on zero-day exploitation typical of this actor and monitor for DNS-based C2 traffic associated with malware such as hcdLoader and gh0st RAT.

APT18· China

APT18

FAQ2

See also6

APT18· China

APT18

FAQ2

See also6