Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Confucius · Unknown · mitre-attack · refreshed 2026-10-06

Confucius

  • Confucius APT

MITRE G0142 ↗

Confucius — ATT&CK roseCO

attack rose · 19 techniques across 9 tactics

What changed

ledger · newest first
  1. —todaynew CVE3 new CVEs: CVE-2015-1641, CVE-2017-11882, CVE-2018-0802

Analyst brief

mitre-attack

Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

19 techniques · 9 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    2 techniques

  3. Execution

    6 techniques

  4. Persistence

    1 technique

  5. Stealth

    2 techniques

  6. Discovery

    2 techniques

  7. Collection

    1 technique

  8. Command and control

    2 techniques

  9. Exfiltration

    2 techniques

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
WarzoneRATS0670 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Confucius is cited as exploiting

none on KEV
  1. CVE-2018-08022026-10-17
    1. “Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2017-118822026-10-17
    1. “Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “Confucius’ backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

  3. CVE-2015-16412026-10-17
    1. “Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “Confucius’ backdoors are delivered through Office files exploiting memory corruption vulnerabilities CVE-2015-1641 and CVE-2017-11882 .”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

4 sources
  1. 1.attack.mitre.org/groups/G0142
  2. 2.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespiona…
  3. 3.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-rel…
  4. 4.uptycs.com/blog/confucius-apt-deploys-warzone-rat

Track Confucius on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.