APT23· China

APT23 is known for targeted spearphishing and USB-based data exfiltration against government entities.

Analyst brief

APT23 (also known as PIRATE PANDA) is a threat actor active since 2012, primarily targeting government, military, and administration entities. Its key TTPs include initial access via Spearphishing Attachment, use of malware like USBferry and ShadowPad, and data exfiltration methods such as Exfiltration over USB. Defenders should focus on securing email attachments, enforcing strict controls on USB devices, and monitoring network traffic for Encrypted Channel C2 communications.

APT23

PIRATE PANDAKeyBoyTropic Trooper

unknown

TrendMicro described Tropic Trooper in a 2015 report as: 'Taiwan and the Philippines have become the targets of an ongoing campaign called Operation TropicTrooper. Active since 2012, the attackers behind the campaign haveset their sights on the Taiwanese government as well as a number of companies in the heavy industry. The same campaign has also targeted key Philippine military agencies.'

origin (suspected)

Chinaattribution confidence: medium (50)

target sectors

MilitaryGovernment, Administration

techniques · ATT&CK

Spearphishing Attachment Windows Command Shell Malicious File Windows Service Registry Run Keys / Startup Folder File Deletion Hidden Files and Directories System Owner/User Discovery+7

malware

USBferry ShadowPad PoisonIvy YAHOYAH KeyBoy BITSAdmin

source: misp-galaxy + mitre-attackG0081 17 refs →

Kill-chain playbook9

01
initial-access
T1566.001
Implement user education and email content monitoring against suspicious spearphishing attachments.
02
execution
T1059.003 T1204.002
Monitor Windows Command Shell activity and executed files to detect malicious file execution.
03
persistence
T1543.003 T1547.001
Detect persistence mechanisms by monitoring Registry Run Keys, Startup Folder, and Windows Service changes.
04
stealth
T1070.004 T1564.001
Detect evasion attempts by monitoring file deletion and hidden file/directory activities.
05
discovery
T1033 T1057
Monitor system and process queries to detect System Owner/User and Process Discovery.
06
lateral-movement
T1091
Monitor removable media activity to detect replication through removable media.
07
collection
T1119
Monitor data collection patterns to detect automated collection activities.
08
command-and-control
T1105 T1573
Monitor network traffic and file transfers to detect encrypted channel and ingress tool transfer activities.
09
exfiltration
T1020 T1052.001
Monitor egress network traffic and USB activity to detect exfiltration over USB and automated exfiltration activities.

FAQ2

Which sectors does APT23 primarily target?

APT23 primarily targets government, military, and administration entities.

What malware tools does APT23 use?

The malware tools used by APT23 include USBferry and ShadowPad.

APT23· China

Analyst brief

APT23

Kill-chain playbook9

initial-access

execution

persistence

stealth

discovery

lateral-movement

collection

command-and-control

exfiltration

FAQ2

See also6

APT23· China

Analyst brief

APT23

Kill-chain playbook9

initial-access

execution

persistence

stealth

discovery

lateral-movement

collection

command-and-control

exfiltration

FAQ2

See also6