APT
ATLAS
Atlas
Actors
145
Names
507
Sectors
40
⌘K
▸
sign in
Atlas
Actors
145
Names
507
Sectors
40
LOADING
APT5 (aka UNC2630, Mulberry Typhoon) · APT Atlas
Actors
/
Nation-state / APT
/
Asia
APT5
G0021
APT
CN · China
AKA
UNC2630 · Mulberry Typhoon · Poisoned Flight
Microsoft
:
MANGANESE
CrowdStrike
:
KEYHOLE PANDA
Secureworks
:
BRONZE FLEETWOOD
MITRE
:
G0021
Targets
15
Sectors
6
Threat types
1
GIRs mapped
0/480
Active since
2007
Explore in atlas
Save actor
Share
Export
STIX 2.1
ATT&CK Navigator
Also tracked as
5 vendor names · 3 other aliases
Open Rosetta Stone
CrowdStrike
KEYHOLE PANDA
Mandiant
APT5
Microsoft
MANGANESE
MITRE
G0021
Secureworks
BRONZE FLEETWOOD
UNATTRIBUTED ALIASES
UNC2630
Mulberry Typhoon
Poisoned Flight
Victimology
Geographic footprint · 15 countries
Export STIX
origin · China
targeted countries · 15
OCEANIA ·
1
Australia
EUROPE ·
9
Belgium
·
Switzerland
·
Germany
·
France
·
United Kingdom
·
Ireland
·
Italy
·
Norway
·
Sweden
AMERICAS ·
2
Canada
·
United States
ASIA ·
3
Japan
·
South Korea
·
Taiwan
Sectors targeted
6 of 40
Government
100 actors
Defense
72 actors
Aerospace
58 actors
Technology
60 actors
Telecom
71 actors
Dissidents (as targets)
16 actors
Tactics, techniques, procedures
Threat types + MITRE ATT&CK mapping
THREAT TYPES
ESP · Espionage
MITRE ATT&CK · 22 techniques
Resource Development
· 1
T1583.005
Botnet
Initial Access
· 1
T1190
Exploit Public-Facing Application
Execution
· 3
T1053.003
Cron
T1059.001
PowerShell
Persistence
· 1
T1554
Compromise Host Software Binary
Credential Access
· 2
T1003.001
LSASS Memory
Discovery
· 4
T1049
System Network Connections Discovery
Lateral Movement
· 2
T1021.001
Remote Desktop Protocol
T1021.004
SSH
Collection
· 1
T1560.001
Archive via Utility
Defense Impairment
· 1
T1685
Disable or Modify Tools
Stealth
· 6
T1036.005
Match Legitimate Resource Name or Location
T1055
Process Injection
GIR mappings
0 / 480 requirements mapped
Open matrix
No GIRs mapped yet for this actor.
References
No supporting references have been recorded for this profile. Treat uncited claims as unverified.
Open data
Machine-readable exports of this profile
JSON · REST
Actor record
Full profile via the public v1 API
STIX 2.1
Intrusion-set bundle
Deterministic ids · techniques + targeted countries
ATT&CK NAVIGATOR
Technique layer
22 techniques · layer format 4.5
Related actors
By origin and actor type
Agrius
nation-state
Iran · 2 targets · since 2020
AppleJeus
nation-state
North Korea · 25 targets · since 2018
APT1
nation-state
China · 17 targets · since 2006
APT10
nation-state
China · 19 targets · since 2009
APT12
nation-state
China · 11 targets · since 2009
APT14
nation-state
China · 15 targets · since —
T1059.003
Windows Command Shell
T1003.002
Security Account Manager
T1057
Process Discovery
T1083
File and Directory Discovery
T1654
Log Enumeration
T1070
Indicator Removal
T1070.004
File Deletion
T1078.002
Domain Accounts
T1078.004
Cloud Accounts