APT19 - G0073

Created: 2018-10-17T00:14:20.652Z

Modified: 2023-03-21T20:44:02.443Z

Contributors: FS-ISAC,Darren Spruell

Aliases

APT19,Codoso,C0d0so0,Codoso Team,Sunshop Group

Description

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016) (Citation: FireEye APT Groups) (Citation: Unit 42 C0d0so0 Jan 2016)

Techniques Used

APT19 used Base64 to obfuscate executed commands.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

APT19 has obtained and used publicly-available tools like

Empire.(Citation: NCSC Joint Report Public Tools)(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

APT19 used

PowerShell windows by setting the WindowStyle parameter to hidden. (Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

APT19 used PowerShell commands to execute payloads.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|