Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.123
- TrendMicro Confucius APT Feb 2018
- TrendMicro Confucius APT Aug 2021
- Uptycs Confucius APT Jan 2021
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Confucius | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Confucius APT | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1221 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1680 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1041 | Exfiltration Over C2 Channel | — |
| T1053.005 | Scheduled Task | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1071.001 | Web Protocols | — |
| T1083 | File and Directory Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1119 | Automated Collection | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.005 | Mshta | — |
| T1221 | Template Injection | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1583.006 | Web Services | — |
| T1680 | Local Storage Discovery | — |
Aliases
Confucius · Confucius APT
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.