APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.123456
- NSA APT5 Citrix Threat Hunting December 2022
- Microsoft East Asia Threats September 2023
- Mandiant Pulse Secure Zero-Day April 2021
- Mandiant Pulse Secure Update May 2021
- FireEye Southeast Asia Threat Landscape March 2015
- Mandiant Advanced Persistent Threats
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1059.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1654 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1554 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1049 | System Network Connections Discovery | — |
| T1053.003 | Cron | — |
| T1055 | Process Injection | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1070 | Indicator Removal | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1074.001 | Local Data Staging | — |
| T1078.002 | Domain Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1136.001 | Local Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1505.003 | Web Shell | — |
| T1554 | Compromise Host Software Binary | — |
| T1560.001 | Archive via Utility | — |
| T1583.005 | Botnet | — |
| T1654 | Log Enumeration | — |
| T1685 | Disable or Modify Tools | — |
别名
APT5 · BRONZE FLEETWOOD · Keyhole Panda · MANGANESE · Mulberry Typhoon · UNC2630
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。