APT18

Threat Actors · APT18

· ATT&CK GroupG0026

TG-0416Dynamite PandaThreat Group-0416

Techniques

Software

Tactics

Aliases

Description

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. (Citation: Dell Lateral Movement)

Tactic Coverage

persistence (4)stealth (3)privilege escalation (3)command and control (3)execution (2)initial access (2)discovery (2)

Techniques Used (12)

T1027.013Encrypted/Encoded File

stealth

T1053.002At

executionpersistence

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 12 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (5)

S0070HTTPBrowsermalware S0124Pisloadermalware S0106cmdtool S0032gh0st RATmalware S0071hcdLoadermalware

References (8)

https://attack.mitre.org/groups/G0026 http://www.secureworks.com/resources/blog/where-you-at-indicators-of-lateral-movement-using-at-exe-on-windows-7-systems/https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop