APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.123456
- NSA APT5 Citrix Threat Hunting December 2022
- Microsoft East Asia Threats September 2023
- Mandiant Pulse Secure Zero-Day April 2021
- Mandiant Pulse Secure Update May 2021
- FireEye Southeast Asia Threat Landscape March 2015
- Mandiant Advanced Persistent Threats
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | APT5 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Mulberry Typhoon | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | MANGANESE | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BRONZE FLEETWOOD | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Keyhole Panda | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | UNC2630 | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1654 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1554 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1049 | System Network Connections Discovery | — |
| T1053.003 | Cron | — |
| T1055 | Process Injection | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1070 | Indicator Removal | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1074.001 | Local Data Staging | — |
| T1078.002 | Domain Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1136.001 | Local Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1505.003 | Web Shell | — |
| T1554 | Compromise Host Software Binary | — |
| T1560.001 | Archive via Utility | — |
| T1583.005 | Botnet | — |
| T1654 | Log Enumeration | — |
| T1685 | Disable or Modify Tools | — |
Aliases
APT5 · BRONZE FLEETWOOD · Keyhole Panda · MANGANESE · Mulberry Typhoon · UNC2630
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.