Actors/Nation-state / APT/Asia

APT20

G0099APTCN · China

AKA TH3Bug · Crawling Taurus · Twivy

CrowdStrike: VIOLIN PANDAMITRE: G0099

Targets14

Sectors6

Threat types1

GIRs mapped0/480

Active since2011

Explore in atlas

Also tracked as

3 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

VIOLIN PANDA

Mandiant

APT20

MITRE

G0099

UNATTRIBUTED ALIASESTH3BugCrawling TaurusTwivy

Victimology

Geographic footprint · 14 countries

Export STIX

origin · Chinatargeted countries · 14

AMERICAS · 2

Canada · United States

EUROPE · 6

Germany · Denmark · France · United Kingdom · Italy · Sweden

ASIA · 6

Hong Kong · India · Japan · South Korea · Mongolia · Taiwan

Sectors targeted

6 of 40

Government100 actors Aerospace58 actors Healthcare46 actors Energy / Utilities58 actors Education & Research62 actors Dissidents (as targets)16 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 0 techniques

No TTPs mapped yet.

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer0 techniques · layer format 4.5

Related actors

By origin and actor type