Trusted Design

Confucius

アクターID: G0142

· MITRE Pageへのリンク

脅威アクターの詳細

Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.(Citation: TrendMicro Confucius APT Feb 2018)(Citation: TrendMicro Confucius APT Aug 2021)(Citation: Uptycs Confucius APT Jan 2021)

脅威アクターの別名・別称

Confucius
Confucius APT

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1087.002 - Domain Account
• T1543.003 - Windows Service
• T1598.003 - Spearphishing Link
• T1487 - Disk Structure Wipe
• T1219.001 - IDE Tunneling
• T1218.012 - Verclsid
• T1608.005 - Link Target
• T1087.004 - Cloud Account
• T1497.002 - User Activity Based Checks
• T1679 - Selective Exclusion
• T1218.010 - Regsvr32
• T1056 - Input Capture
• T1200 - Hardware Additions
• T1556.005 - Reversible Encryption
• T1027.010 - Command Obfuscation
• T1547.013 - XDG Autostart Entries
• T1027.018 - Invisible Unicode
• T1665 - Hide Infrastructure

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1027.018)
• CVE-2015-1770 (T1027.018)
• CVE-2015-2545 (T1027.018)
• CVE-2017-0199 (T1027.018)
• CVE-2012-0158 (T1027.018)
• CVE-2013-3906 (T1218.010)
• CVE-2014-6352 (T1027.010)
• CVE-2015-0016 (T1027.018)
• CVE-2010-3333 (T1027.018)
• CVE-2010-0188 (T1027.018)
• CVE-2010-2884 (T1218.012)
• CVE-2013-0640 (T1218.012)
• CVE-2011-0611 (T1218.010)
• CVE-2015-0071 (T1027.018)
• CVE-2010-1553 (T1027.018)
• CVE-2014-1761 (T1218.010)
• CVE-2015-2853 (T1027.018)
• CVE-2017-16929 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2013-7331 (T1200)
• CVE-2009-3129 (T1027.018)
• CVE-2013-5990 (T1027.018)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2012-1856 (T1027.018)
• CVE-2015-2546 (T1027.018)
• CVE-2014-6332 (T1027.018)
• CVE-2015-3785 (T1218.012)
• CVE-2015-5897 (T1087.004)
• CVE-2015-3043 (T1027.018)
• CVE-2015-3090 (T1027.018)
• CVE-2015-3113 (T1218.010)
• CVE-2015-2590 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2015-4495 (T1218.010)
• CVE-2015-2502 (T1027.018)
• CVE-2014-6271 (T1665)
• CVE-2014-4113 (T1027.018)
• CVE-2016-1990 (T1218.012)
• CVE-2016-1991 (T1218.012)
• CVE-2016-1010 (T1027.018)
• CVE-2016-1019 (T1218.012)
• CVE-2016-0984 (T1027.018)
• CVE-2016-1001 (T1218.010)
• CVE-2016-0998 (T1027.018)
• CVE-2015-1641 (T1027.018)
• CVE-2015-1701 (T1027.018)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2015-5130 (T1027.018)
• CVE-2015-5134 (T1027.018)
• CVE-2015-5539 (T1027.018)
• CVE-2015-5557 (T1027.018)
• CVE-2015-5563 (T1027.018)
• CVE-2015-5559 (T1027.018)
• CVE-2015-5540 (T1027.018)
• CVE-2015-5561 (T1027.018)
• CVE-2015-5551 (T1027.018)
• CVE-2015-5564 (T1027.018)
• CVE-2015-5565 (T1027.018)
• CVE-2015-5550 (T1027.018)
• CVE-2015-5566 (T1027.018)
• CVE-2015-5127 (T1027.018)
• CVE-2015-5556 (T1027.018)
• CVE-2015-3628 (T1218.010)
• CVE-2015-2852 (T1027.018)
• CVE-2015-2854 (T1027.018)
• CVE-2012-4969 (T1027.018)
• CVE-2015-6022 (T1027.018)
• CVE-2017-0263 (T1027.018)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2025-55182 (T1027.018)
• CVE-2015-0311 (T1027.018)
• CVE-2010-3081 (T1218.012)
• CVE-2012-3213 (T1027.018)
• CVE-2012-4792 (T1027.018)
• CVE-2014-0322 (T1027.018)
• CVE-2012-1258 (T1219.001)
• CVE-2015-0336 (T1027.018)
• CVE-2011-3544 (T1027.018)
• CVE-2014-3153 (T1218.010)
• CVE-2014-4322 (T1218.012)
• CVE-2015-3636 (T1608.005)
• CVE-2013-6282 (T1218.012)
• CVE-2015-3105 (T1218.010)
• CVE-2014-0497 (T1218.010)
• CVE-2017-17215 (T1027.018)
• CVE-2013-0074 (T1027.018)
• CVE-2012-0507 (T1027.018)
• CVE-2013-2465 (T1027.018)
• CVE-2014-8439 (T1218.012)
• CVE-2013-2551 (T1027.018)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1218.010)
• CVE-2015-0310 (T1218.010)
• CVE-2014-1776 (T1027.018)
• CVE-2014-0556 (T1027.018)
• CVE-2015-5560 (T1219.001)
• CVE-2015-0057 (T1027.018)
• CVE-2014-9163 (T1218.010)
• CVE-2012-1723 (T1027.018)
• CVE-2015-1761 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2010-0806 (T1027.018)
• CVE-2015-2360 (T1027.018)
• CVE-2014-4148 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2014-7247 (T1027.018)
• CVE-2013-2678 (T1027.018)
• CVE-2015-2426 (T1027.018)
• CVE-2008-1436 (T1218.012)
• CVE-2010-0232 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2014-3393 (T1218.012)
• CVE-2014-2273 (T1218.012)
• CVE-2015-4902 (T1027.018)
• CVE-2014-3897 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2017-8570 (T1027.018)
• CVE-2012-0611 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2016-4117 (T1218.010)
• CVE-2017-0001 (T1027.018)
• CVE-2017-0143 (T1027.018)
• CVE-2023-1389 (T1027.018)
• CVE-2025-24893 (T1027.018)
• CVE-2025-31125 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2025-55183 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2025-66478 (T1219.001)
• CVE-2025-68645 (T1027.018)
• CVE-2026-0723 (T1218.012)
• CVE-2026-20127 (T1027.018)
• CVE-2015-1427 (T1218.012)
• CVE-2015-7645 (T1027.018)
• CVE-2017-12149 (T1027.018)
• CVE-2015-3456 (T1218.012)
• CVE-2015-5477 (T1218.012)
• CVE-2013-2094 (T1027.018)
• CVE-2015-8562 (T1027.018)
• CVE-2015-7808 (T1218.010)
• CVE-2012-1889 (T1218.012)
• CVE-2015-5749 (T1218.012)
• CVE-2015-7755 (T1218.010)
• CVE-2016-1287 (T1218.012)
• CVE-2015-7261 (T1027.018)
• CVE-2015-6036 (T1027.018)
• CVE-2015-7262 (T1218.012)
• CVE-2016-1562 (T1218.012)
• CVE-2016-2342 (T1608.005)
• CVE-2016-2343 (T1218.012)
• CVE-2016-6532 (T1218.012)
• CVE-2016-9494 (T1027.018)
• CVE-2016-9496 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2017-3212 (T1218.012)
• CVE-2015-0932 (T1218.012)
• CVE-2012-0056 (T1218.012)
• CVE-2014-7911 (T1218.012)
• CVE-2014-8361 (T1556.005)
• CVE-2012-4681 (T1027.018)
• CVE-2010-1297 (T1027.018)
• CVE-2010-2883 (T1218.012)
• CVE-2013-0634 (T1218.012)
• CVE-2012-5054 (T1218.012)
• CVE-2010-0738 (T1218.012)
• CVE-2013-0641 (T1218.012)
• CVE-2012-6422 (T1218.012)
• CVE-2013-2595 (T1200)
• CVE-2017-7255 (T1218.012)
• CVE-2025-13335 (T1218.012)
• CVE-2025-13927 (T1218.012)
• CVE-2025-13928 (T1218.012)
• CVE-2026-1102 (T1218.012)
• CVE-2015-8287 (T1218.010)
• CVE-2025-61882 (T1200)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る