Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Tonto Team · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

Tonto Team

  • CactusPete
  • KARMA PANDA
  • BRONZE HUNTLEY
  • COPPER
  • Red Beifang
  • G0131
  • PLA Unit 65017
  • Earth Akhlut

state sponsor · ChinaMITRE G0131 ↗

Tonto Team — ATT&CK roseTT

attack rose · 15 techniques across 10 tactics

What changed

ledger · newest first
  1. —todaynew CVE7 new CVEs: CVE-2017-11882, CVE-2018-0798, CVE-2018-0802, CVE-2018-8174, CVE-2019-0803, CVE-2019-9489 +1 more

Analyst brief

misp-galaxy + mitre-attack

Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malware, including the Bisonal RAT and ShadowPad. They employ spear-phishing emails with malicious attachments as their preferred method of distribution.

Observed targets (as stated by the sources)

4 countries · 3 sectors
JapanSouth KoreaTaiwanUnited StatesAssessed origin: China

assessed origin · Chinaobserved targets · 4

countries · 4

  • Japan
  • South Korea
  • Taiwan
  • United States

sectors · 3

  • Military
  • Government
  • Private sector

also stated: Eastern Europe

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

15 techniques · 10 of 15 tactics

  1. Initial access

    1 technique

  2. Execution

    4 techniques

  3. Persistence

    1 technique

  4. Privilege escalation

    1 technique

  5. Stealth

    1 technique

  6. Credential access

    1 technique

  7. Discovery

    2 techniques

  8. Lateral movement

    1 technique

  9. Collection

    1 technique

  10. Command and control

    2 techniques

select a technique

Arsenal

2 malware · 4 tools
Malware
Malware · 2ATT&CK
BisonalS0268 ↗
ShadowPadS0596 ↗
Tools
Tools · 4ATT&CK
MimikatzS0002 ↗
LaZagneS0349 ↗
NBTscanS0590 ↗
gsecdumpS0008 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Tonto Team is cited as exploiting

none on KEV
  1. CVE-2019-08032026-10-17
    1. “Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2020-84682026-10-17
    1. “Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2019-94892026-10-17
    1. “Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2017-118822026-10-17
    1. “Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  5. CVE-2018-08022026-10-17
    1. “Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  6. CVE-2018-81742026-10-17
    1. “Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  7. CVE-2018-07982026-10-17
    1. “Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

18 sources
  1. 1.arstechnica.com/information-technology/2017/04/researchers-claim-china…
  2. 2.docs.huihoo.com/rsaconference/usa-2014/anf-t07b-the-art-of-attribution…
  3. 3.securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962
  4. 4.wsj.com/articles/chinas-secret-weapon-in-south-korea-missile-f…
  5. 5.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-re…
  6. 6.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/…
  7. 7.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups
  8. 8.trendmicro.com/en_us/research/23/g/supply-chain-attack-targeting-paki…
  9. 9.sentinelone.com/labs/targets-of-interest-russian-organizations-increas…
  10. 10.go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf
  11. +8 more in the JSON record

Track Tonto Team on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.