Actors/Nation-state / APT/Asia

APT40

APTCN · China

AKA Temp.Jumper · Gingham Typhoon · Temp.Periscope · Mudcarp · ITG09 · ISLANDDREAMS · Leviathan · Feverdream

Microsoft: GADOLINIUMCrowdStrike: KRYPTONITE PANDASecureworks: BRONZE MOHAWK

Targets17

Sectors15

Threat types1

GIRs covered0/480

Active since2013

Also tracked as

4 vendor names · 8 other aliases

Open Rosetta Stone

CrowdStrike

KRYPTONITE PANDA

Mandiant

APT40

Microsoft

GADOLINIUM

Secureworks

BRONZE MOHAWK

UNATTRIBUTED ALIASESTemp.JumperGingham TyphoonTemp.PeriscopeMudcarpITG09ISLANDDREAMSLeviathanFeverdream

Victimology

Geographic footprint · 17 countries

origin · Chinatargeted countries · 17

EUROPE · 6

Austria · Belgium · Switzerland · Germany · United Kingdom · Norway

OCEANIA · 1

Australia

ASIA · 9

Hong Kong · Indonesia · India · Cambodia · Myanmar · Malaysia · Philippines · Saudi Arabia · Taiwan

AMERICAS · 1

United States

Sectors targeted

15 of 40

Government100 actors Defense72 actors Aviation22 actors Healthcare47 actors Pharmaceutical27 actors Technology60 actors Telecom72 actors NGOs & Dissidents56 actors Education & Research62 actors Transportation31 actors Legal & Professional18 actors Industrials / Engineering29 actors Chemicals20 actors Private Sector (generic)29 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 30 techniques

Reconnaissance · 1

T1589.001Credentials

Initial Access · 4

T1189Drive-by Compromise T1190Exploit Public-Facing Application T1566.001Spearphishing Attachment T1566.002Spearphishing Link

Execution · 5

T1047Windows Management Instrumentation

Persistence · 2

Credential Access · 2

T1003OS Credential Dumping

Lateral Movement · 3

T1021.001Remote Desktop Protocol T1021.004SSH

Collection · 1

T1560Archive Collected Data

Exfiltration · 2

T1041Exfiltration Over C2 Channel T1567.002Exfiltration to Cloud Storage

Command And Control · 3

T1090.003Multi-hop Proxy

Stealth · 7

T1027.003Steganography

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer30 techniques · layer format 4.5

Related actors

By origin and actor type

T1059.001

PowerShell

T1059.005Visual Basic

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1547.001

Registry Run Keys / Startup Folder

T1547.009Shortcut Modification

T1003.001

LSASS Memory

T1534

Internal Spearphishing

T1102.003

One-Way Communication

T1105Ingress Tool Transfer

T1027.015

Compression

T1055.001Dynamic-link Library Injection

T1078Valid Accounts

T1140Deobfuscate/Decode Files or Information

T1197BITS Jobs

T1218.010Regsvr32