Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).123456
- Kaspersky CactusPete Aug 2020
- ESET Exchange Mar 2021
- FireEye Chinese Espionage October 2019
- ARS Technica China Hack SK April 2017
- Trend Micro HeartBeat Campaign January 2013
- Talos Bisonal 10 Years March 2020
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Tonto Team | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Earth Akhlut | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BRONZE HUNTLEY | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | CactusPete | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Karma Panda | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2021 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003 | OS Credential Dumping | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.006 | Python | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1069.001 | Local Groups | — |
| T1090.002 | External Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1135 | Network Share Discovery | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1210 | Exploitation of Remote Services | — |
| T1505.003 | Web Shell | — |
| T1566.001 | Spearphishing Attachment | — |
| T1574.001 | DLL | — |
别名
BRONZE HUNTLEY · CactusPete · Earth Akhlut · Karma Panda · Tonto Team
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。