APT
ATLAS
Atlas
Actors
145
Names
507
Sectors
40
⌘K
▸
sign in
Atlas
Actors
145
Names
507
Sectors
40
LOADING
APT19 (aka Codoso, Sunshop Group) · APT Atlas
Actors
/
Nation-state / APT
/
Asia
APT19
G0073
APT
CN · China
AKA
Codoso · Sunshop Group · C0d0so · Shell Crew · Pupa · KungFu Kittens · Group 13 · Black Vine
Secureworks
:
IRON LYRIC
CrowdStrike
:
DEEP PANDA
MITRE
:
G0073
Targets
19
Sectors
18
Threat types
1
GIRs mapped
0/480
Active since
2013
Explore in atlas
Save actor
Share
Export
STIX 2.1
ATT&CK Navigator
Also tracked as
4 vendor names · 8 other aliases
Open Rosetta Stone
CrowdStrike
DEEP PANDA
Mandiant
APT19
MITRE
G0073
Secureworks
IRON LYRIC
UNATTRIBUTED ALIASES
Codoso
Sunshop Group
C0d0so
Shell Crew
Pupa
KungFu Kittens
Group 13
Black Vine
Victimology
Geographic footprint · 19 countries
Export STIX
origin · China
targeted countries · 19
OCEANIA ·
1
Australia
AMERICAS ·
5
Brazil
·
Canada
·
Colombia
·
United States
·
Uruguay
ASIA ·
8
China
·
Hong Kong
·
India
·
Japan
·
South Korea
·
Mongolia
·
Philippines
·
Saudi Arabia
EUROPE ·
5
Germany
·
United Kingdom
·
Italy
·
Netherlands
·
Sweden
Sectors targeted
18 of 40
Government
100 actors
Defense
72 actors
Aerospace
58 actors
Financial Services
73 actors
Healthcare
46 actors
Pharmaceutical
26 actors
Technology
60 actors
Telecom
71 actors
Retail & Hospitality
32 actors
NGOs & Dissidents
56 actors
Education & Research
62 actors
Media & Journalism
48 actors
Transportation
31 actors
Food and Beverage
9 actors
Legal & Professional
17 actors
Chemicals
20 actors
Private Sector (generic)
29 actors
Dissidents (as targets)
16 actors
Tactics, techniques, procedures
Threat types + MITRE ATT&CK mapping
THREAT TYPES
ESP · Espionage
MITRE ATT&CK · 15 techniques
Initial Access
· 2
T1189
Drive-by Compromise
T1566.001
Spearphishing Attachment
Execution
· 2
T1059
Command and Scripting Interpreter
Persistence
· 2
T1543.003
Windows Service
Discovery
· 2
T1016
System Network Configuration Discovery
Command And Control
· 1
T1071.001
Web Protocols
Defense Impairment
· 1
T1112
Modify Registry
Stealth
· 5
T1027.010
Command Obfuscation
GIR mappings
0 / 480 requirements mapped
Open matrix
No GIRs mapped yet for this actor.
References
No supporting references have been recorded for this profile. Treat uncited claims as unverified.
Open data
Machine-readable exports of this profile
JSON · REST
Actor record
Full profile via the public v1 API
STIX 2.1
Intrusion-set bundle
Deterministic ids · techniques + targeted countries
ATT&CK NAVIGATOR
Technique layer
15 techniques · layer format 4.5
Related actors
By origin and actor type
Agrius
nation-state
Iran · 2 targets · since 2020
AppleJeus
nation-state
North Korea · 25 targets · since 2018
APT1
nation-state
China · 17 targets · since 2006
APT10
nation-state
China · 19 targets · since 2009
APT12
nation-state
China · 11 targets · since 2009
APT14
nation-state
China · 15 targets · since —
T1059.001
PowerShell
T1547.001
Registry Run Keys / Startup Folder
T1033
System Owner/User Discovery
T1140
Deobfuscate/Decode Files or Information
T1218.010
Regsvr32
T1218.011
Rundll32
T1564.003
Hidden Window