Confucius

Techniques (MITRE ATT&CK)19

SourceMITRE ATT&CK

Also known as:Confucius APT

About the group

Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity56

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 19

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Web Services

Initial access

Spearphishing Attachment Spearphishing Link

Execution

Scheduled Task PowerShell Visual Basic Exploitation for Client Execution Malicious Link Malicious File

Persistence

Registry Run Keys / Startup Folder

Discovery

File and Directory Discovery Local Storage Discovery

Collection

Automated Collection

Command and control

Web Protocols Ingress Tool Transfer

Exfiltration

Exfiltration Over C2 Channel Exfiltration to Cloud Storage

stealth

Mshta Template Injection

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2015-1641HIGHEPSS 97%KEV MITRE ATT&CK

CVE-2018-0802HIGHEPSS 93%KEV MITRE ATT&CK

Confucius uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →