Tonto Team· China

Tonto Team is a China-linked APT group known for cyber espionage targeting military and government entities.

Analyst brief

Tonto Team is a Chinese nation-state APT group active since at least 2013. It primarily targets military, government, and private sector entities in Eastern Europe, the US, Japan, South Korea, and Taiwan. They gain initial access via Spearphishing Attachments and deploy Bisonal RAT, ShadowPad, and Web Shells, using tools like Mimikatz and LaZagne for OS Credential Dumping and Keylogging. Defenders should focus on detecting malicious email attachments, unauthorized Python script execution, Network Share Discovery, and C2 communications via External Proxies.

Tonto Team

CactusPeteKARMA PANDABRONZE HUNTLEY

nation-state

Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malware, including the Bisonal RAT and ShadowPad. They employ spear-phishing emails with malicious attachments as their preferred method of distribution.

origin (suspected)

China· state-sponsoredattribution confidence: medium (50)

target countries (as stated by the source)

Eastern EuropeJapanSouth KoreaTaiwan

target sectors

MilitaryGovernmentPrivate sector

techniques · ATT&CK

Spearphishing Attachment Python Exploitation for Client Execution Web Shell Exploitation for Privilege Escalation DLL OS Credential Dumping Local Groups+5

malware

Bisonal ShadowPad Mimikatz LaZagne NBTscan gsecdump

source: misp-galaxy + mitre-attackG0131 18 refs →

Kill-chain playbook10

01
initial-access
T1566.001
Monitor email attachments for Spearphishing Attachment and implement user awareness training.
02
execution
T1059.006 T1203
Implement endpoint logging and process monitoring to detect Python scripts and exploitation of client software.
03
persistence
T1505.003
Implement web server logging and file system monitoring to detect Web Shell.
04
privilege-escalation
T1068
Implement vulnerability management to detect and prevent Exploitation for Privilege Escalation.
05
stealth
T1574.001
Implement process monitoring and anomaly detection to identify DLL side-loading.
06
credential-access
T1003
Implement LSASS monitoring to detect OS Credential Dumping.
07
discovery
T1069.001 T1135
Implement system and network logging to detect Local Groups and Network Share Discovery.
08
lateral-movement
T1210
Implement network traffic monitoring and anomaly detection to identify Exploitation of Remote Services.
09
collection
T1056.001
Implement endpoint monitoring and user activity monitoring to detect Keylogging.
10
command-and-control
T1090.002 T1105
Configure network traffic monitoring and firewall to detect External Proxy and Ingress Tool Transfer.

FAQ2

What method does the Tonto Team APT group typically use for initial access?

Tonto Team typically uses Spearphishing Attachments as their method for initial access.

What are some of the malware used by Tonto Team?

Malware used by the group includes Bisonal RAT, ShadowPad, and Web Shells.

Tonto Team· China

Analyst brief

Tonto Team

Kill-chain playbook10

initial-access

execution

persistence

privilege-escalation

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

FAQ2

See also6

Tonto Team· China

Analyst brief

Tonto Team

Kill-chain playbook10

initial-access

execution

persistence

privilege-escalation

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

FAQ2

See also6