Actors/Nation-state / APT/Asia

Tonto Team

G0131APTCN · China

AKA Earth Akhlut · CactusPete · HeartBeat

CrowdStrike: KARMA PANDAMicrosoft: Purple TyphoonMITRE: G0131Secureworks: BRONZE HUNTLEY

Targets10

Sectors6

Threat types1

GIRs covered0/480

Active since2009

Also tracked as

4 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

KARMA PANDA

Microsoft

Purple Typhoon

MITRE

G0131

Secureworks

BRONZE HUNTLEY

UNATTRIBUTED ALIASESEarth AkhlutCactusPeteHeartBeat

Victimology

Geographic footprint · 10 countries

origin · Chinatargeted countries · 10

ASIA · 5

China · Japan · South Korea · Mongolia · Türkiye

EUROPE · 4

Germany · Italy · Russia · Ukraine

AMERICAS · 1

Peru

Sectors targeted

6 of 40

Government100 actors Defense72 actors Aerospace59 actors Manufacturing (man)50 actors Private Sector (generic)29 actors Dissidents (as targets)16 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 10 techniques

Initial Access · 1

T1566.001Spearphishing Attachment

Execution · 3

T1059.001PowerShell T1059.006Python T1203Exploitation for Client Execution

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 1

T1003OS Credential Dumping

Discovery · 2

T1069.001Local Groups T1135Network Share Discovery

Lateral Movement · 1

T1210Exploitation of Remote Services

Command And Control · 1

T1105Ingress Tool Transfer

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer10 techniques · layer format 4.5

Related actors

By origin and actor type