APT18

APT / StateG0026
Techniques (MITRE ATT&CK)12
SourceMITRE ATT&CK
State sponsor: ChinaAttribution confidence: 50%Target categories: Government, Private sector, Civil society
Targeted regions: United States
Also known as:DYNAMITE PANDADynamite PandaG0026PLA NavySCANDIUMSatin TyphoonTG-0416Threat Group-0416Wekby

Vexday analysis

APT18 (também identificado como TG-0416, Dynamite Panda e Threat Group-0416) é um grupo de ameaça persistente avançada rastreado pelo MITRE ATT&CK sob o identificador G0026, com atividade documentada desde pelo menos 2009. O grupo tem como alvos setores variados, incluindo tecnologia, manufatura, organizações de direitos humanos, governo e área médica. Sua atuação é mapeada por 12 técnicas no framework MITRE ATT&CK.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity19
Impact: High
T1053.002T1133EXECExecutionAtPERSPersistenceExternal RemoteServicesDISCDiscoverySystem InformationDiscovery

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 12

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Known infrastructure 3

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

sha256_hash96c0911c225219cfd380076f5196d7ee87c617cddb968d3d465122473e20d6fbGh0stRATmalwarebazaar
sha256_hash0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075dGh0stRATmalwarebazaar
sha256_hash69e2433df06b829e98e5a6c8f552b9371795fb65df62fa4cfb7362970d1ce744Gh0stRATmalwarebazaar

APT18 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →