admin@338

Origin🇨🇳 China

Techniques (MITRE ATT&CK)12

SourceMITRE ATT&CK

State sponsor: ChinaAttribution confidence: 50%Target categories: Government, Private sector, Civil society

Targeted regions: Hong Kong · United States

Also known as:G0018MAGNESIUMTeam338

About the group

admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity34

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 12

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Initial access

Spearphishing Attachment

Execution

Windows Command Shell Exploitation for Client Execution Malicious File

Discovery

System Service Discovery System Network Configuration Discovery System Network Connections Discovery Local Groups System Information Discovery File and Directory Discovery Local Account

stealth

Match Legitimate Resource Name or Location

Exploited vulnerabilities 1

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2012-0158HIGHEPSS 100%KEV MITRE ATT&CK

References

admin@338 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →