File · TA459 · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 5 techniques across 2 tactics
What changed
ledger · newest first- —todaynew CVE1 new CVE: CVE-2017-0199
Analyst brief
misp-galaxy + mitre-attackTA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others.
Kill chain
MITRE ATT&CK Enterprise · tap a technique5 techniques · 2 of 15 tactics
Initial access
1 techniqueExecution
4 techniques
select a technique
Arsenal
4 malwareas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
CVEs TA459 is cited as exploiting
none on KEV- CVE-2017-01992026-10-17
“TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.”
cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
“This time, however, attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan (RAT).”
cited as exploiting · named nearby · source: proofpoint.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
3 sourcesTrack TA459 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.