APT18 - G0026

Created: 2017-05-31T21:31:57.733Z

Modified: 2020-03-30T18:46:16.853Z

Contributors:

Aliases

APT18,TG-0416,Dynamite Panda,Threat Group-0416

Description

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. (Citation: Dell Lateral Movement)

Techniques Used

APT18 uses DNS for C2 communications.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT18 establishes persistence via the

APT18 obfuscates strings in the payload.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

APT18 uses cmd.exe to execute commands on the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)(Citation: Anomali Evasive Maneuvers July 2015)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT18 can upload a file to the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT18 can list files information for specific directories.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT18 uses HTTP for C2 communications.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|