APT17 - G0025

Created: 2017-05-31T21:31:57.307Z

Modified: 2020-10-13T22:33:14.018Z

Contributors:

Aliases

APT17,Deputy Dog

Description

APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. (Citation: FireEye APT17)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|PRE|T1585|Establish Accounts|APT17 has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.(Citation: FireEye APT17)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.(Citation: FireEye APT17)|