APT
ATLAS
Atlas
Actors
145
Names
507
Sectors
40
⌘K
▸
sign in
Atlas
Actors
145
Names
507
Sectors
40
LOADING
APT18 (aka Wekby, Threat Group-0416) · APT Atlas
Actors
/
Nation-state / APT
/
Asia
APT18
G0026
APT
CN · China
AKA
Wekby · Threat Group-0416 · Wekby Group
Microsoft
:
SCANDIUM
CrowdStrike
:
DYNAMITE PANDA
Secureworks
:
TG-0416
MITRE
:
G0026
Targets
16
Sectors
9
Threat types
1
GIRs mapped
0/480
Active since
2009
Explore in atlas
Save actor
Share
Export
STIX 2.1
ATT&CK Navigator
Also tracked as
5 vendor names · 3 other aliases
Open Rosetta Stone
CrowdStrike
DYNAMITE PANDA
Mandiant
APT18
Microsoft
SCANDIUM
MITRE
G0026
Secureworks
TG-0416
UNATTRIBUTED ALIASES
Wekby
Threat Group-0416
Wekby Group
Victimology
Geographic footprint · 16 countries
Export STIX
origin · China
targeted countries · 16
ASIA ·
4
Bangladesh
·
China
·
Israel
·
India
AMERICAS ·
2
Canada
·
United States
EUROPE ·
10
Switzerland
·
Germany
·
Denmark
·
France
·
United Kingdom
·
Italy
·
Netherlands
·
Norway
·
Romania
·
Sweden
Sectors targeted
9 of 40
Government
100 actors
Defense
72 actors
Aerospace
58 actors
Financial Services
73 actors
Healthcare
46 actors
Pharmaceutical
26 actors
NGOs & Dissidents
56 actors
Chemicals
20 actors
Private Sector (generic)
29 actors
Tactics, techniques, procedures
Threat types + MITRE ATT&CK mapping
THREAT TYPES
ESP · Espionage
MITRE ATT&CK · 9 techniques
Execution
· 2
T1053.002
At
T1059.003
Windows Command Shell
Persistence
· 1
Discovery
· 1
T1083
File and Directory Discovery
Command And Control
· 3
T1071.001
Web Protocols
T1071.004
DNS
Stealth
· 2
T1070.004
File Deletion
T1078
Valid Accounts
GIR mappings
0 / 480 requirements mapped
Open matrix
No GIRs mapped yet for this actor.
References
No supporting references have been recorded for this profile. Treat uncited claims as unverified.
Open data
Machine-readable exports of this profile
JSON · REST
Actor record
Full profile via the public v1 API
STIX 2.1
Intrusion-set bundle
Deterministic ids · techniques + targeted countries
ATT&CK NAVIGATOR
Technique layer
9 techniques · layer format 4.5
Related actors
By origin and actor type
Agrius
nation-state
Iran · 2 targets · since 2020
AppleJeus
nation-state
North Korea · 25 targets · since 2018
APT1
nation-state
China · 17 targets · since 2006
APT10
nation-state
China · 19 targets · since 2009
APT12
nation-state
China · 11 targets · since 2009
APT14
nation-state
China · 15 targets · since —
T1547.001
Registry Run Keys / Startup Folder
T1105
Ingress Tool Transfer