Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).123456
- Kaspersky CactusPete Aug 2020
- ESET Exchange Mar 2021
- FireEye Chinese Espionage October 2019
- ARS Technica China Hack SK April 2017
- Trend Micro HeartBeat Campaign January 2013
- Talos Bisonal 10 Years March 2020
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1135 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2021 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003 | OS Credential Dumping | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.006 | Python | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1069.001 | Local Groups | — |
| T1090.002 | External Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1135 | Network Share Discovery | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1210 | Exploitation of Remote Services | — |
| T1505.003 | Web Shell | — |
| T1566.001 | Spearphishing Attachment | — |
| T1574.001 | DLL | — |
Aliases
BRONZE HUNTLEY · CactusPete · Earth Akhlut · Karma Panda · Tonto Team
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.