Trusted Design

APT5

アクターID: G1023

· MITRE Pageへのリンク

脅威アクターの詳細

APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.(Citation: NSA APT5 Citrix Threat Hunting December 2022)(Citation: Microsoft East Asia Threats September 2023)(Citation: Mandiant Pulse Secure Zero-Day April 2021)(Citation: Mandiant Pulse Secure Update May 2021)(Citation: FireEye Southeast Asia Threat Landscape March 2015)(Citation: Mandiant Advanced Persistent Threats)

脅威アクターの別名・別称

APT5
Mulberry Typhoon
MANGANESE
BRONZE FLEETWOOD
Keyhole Panda
UNC2630

利用した攻撃手法

• T1560.001 - Archive via Utility
• T1596.003 - Digital Certificates
• T1584.008 - Network Devices
• T1116 - Code Signing
• T1218.013 - Mavinject
• T1180 - Screensaver
• T1165 - Startup Items
• T1027.008 - Stripped Payloads
• T1106 - Native API
• T1536 - Revert Cloud Instance
• T1140 - Deobfuscate/Decode Files or Information
• T1684 - Social Engineering
• T1567.004 - Exfiltration Over Webhook
• T1555.003 - Credentials from Web Browsers
• T1583.004 - Server
• T1546.005 - Trap
• T1578.003 - Delete Cloud Instance
• T1677 - Poisoned Pipeline Execution
• T1219.001 - IDE Tunneling
• T1055.004 - Asynchronous Procedure Call
• T1102 - Web Service
• T1583.006 - Web Services
• T1546.003 - Windows Management Instrumentation Event Subscription
• T1497.002 - User Activity Based Checks
• T1166 - Setuid and Setgid
• T1591.004 - Identify Roles
• T1070.009 - Clear Persistence
• T1622 - Debugger Evasion
• T1021.001 - Remote Desktop Protocol

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1219.001)
• CVE-2015-5749 (T1584.008)
• CVE-2016-1898 (T1140)
• CVE-2016-1897 (T1140)
• CVE-2015-7261 (T1140)
• CVE-2015-6036 (T1027.008)
• CVE-2015-7262 (T1027.008)
• CVE-2015-0932 (T1140)
• CVE-2010-3081 (T1219.001)
• CVE-2017-16929 (T1219.001)
• CVE-2025-31125 (T1219.001)
• CVE-2025-68645 (T1219.001)
• CVE-2025-55182 (T1055.004)
• CVE-2023-1389 (T1219.001)
• CVE-2025-13928 (T1055.004)
• CVE-2025-24893 (T1219.001)
• CVE-2025-34026 (T1055.004)
• CVE-2025-55184 (T1055.004)
• CVE-2014-4114 (T1497.002)
• CVE-2015-5119 (T1219.001)
• CVE-2015-5122 (T1219.001)
• CVE-2015-1427 (T1555.003)
• CVE-2015-1770 (T1622)
• CVE-2012-1856 (T1219.001)
• CVE-2015-2545 (T1219.001)
• CVE-2015-2546 (T1219.001)
• CVE-2014-6332 (T1219.001)
• CVE-2015-3785 (T1219.001)
• CVE-2015-5897 (T1219.001)
• CVE-2015-7645 (T1140)
• CVE-2017-0199 (T1622)
• CVE-2017-12149 (T1102)
• CVE-2015-3043 (T1219.001)
• CVE-2015-3090 (T1219.001)
• CVE-2015-3113 (T1219.001)
• CVE-2015-2590 (T1219.001)
• CVE-2015-2424 (T1219.001)
• CVE-2015-0097 (T1219.001)
• CVE-2012-0158 (T1055.004)
• CVE-2014-1761 (T1140)
• CVE-2015-2502 (T1219.001)
• CVE-2014-6271 (T1591.004)
• CVE-2013-2094 (T1140)
• CVE-2014-4113 (T1219.001)
• CVE-2015-8562 (T1027.008)
• CVE-2015-7808 (T1027.008)
• CVE-2012-1889 (T1027.008)
• CVE-2016-1990 (T1219.001)
• CVE-2016-1991 (T1219.001)
• CVE-2016-1010 (T1219.001)
• CVE-2016-0984 (T1219.001)
• CVE-2016-1001 (T1219.001)
• CVE-2016-0998 (T1219.001)
• CVE-2015-1641 (T1219.001)
• CVE-2015-1701 (T1219.001)
• CVE-2015-0313 (T1219.001)
• CVE-2015-0359 (T1219.001)
• CVE-2014-0329 (T1219.001)
• CVE-2015-5130 (T1219.001)
• CVE-2015-5134 (T1219.001)
• CVE-2015-5539 (T1219.001)
• CVE-2015-5557 (T1219.001)
• CVE-2015-5563 (T1219.001)
• CVE-2015-5559 (T1219.001)
• CVE-2015-5540 (T1219.001)
• CVE-2015-5561 (T1219.001)
• CVE-2015-5551 (T1219.001)
• CVE-2015-5564 (T1219.001)
• CVE-2015-5565 (T1219.001)
• CVE-2015-5550 (T1219.001)
• CVE-2015-5566 (T1219.001)
• CVE-2015-5127 (T1219.001)
• CVE-2015-5556 (T1219.001)
• CVE-2015-3628 (T1102)
• CVE-2015-2852 (T1219.001)
• CVE-2015-2854 (T1219.001)
• CVE-2015-2853 (T1219.001)
• CVE-2015-7755 (T1027.008)
• CVE-2012-4969 (T1591.004)
• CVE-2016-1287 (T1055.004)
• CVE-2015-6585 (T1027.008)
• CVE-2015-6022 (T1219.001)
• CVE-2015-8286 (T1140)
• CVE-2015-8287 (T1140)
• CVE-2016-1562 (T1027.008)
• CVE-2016-2342 (T1055.004)
• CVE-2016-2343 (T1027.008)
• CVE-2017-0263 (T1219.001)
• CVE-2016-6532 (T1546.005)
• CVE-2016-9494 (T1140)
• CVE-2016-9496 (T1027.008)
• CVE-2016-9495 (T1584.008)
• CVE-2017-3212 (T1027.008)
• CVE-2025-61882 (T1584.008)
• CVE-2015-0311 (T1219.001)
• CVE-2012-3213 (T1219.001)
• CVE-2012-4792 (T1219.001)
• CVE-2012-1258 (T1055.004)
• CVE-2015-0336 (T1219.001)
• CVE-2014-3153 (T1219.001)
• CVE-2014-4322 (T1219.001)
• CVE-2015-3105 (T1219.001)
• CVE-2014-0497 (T1219.001)
• CVE-2014-8361 (T1027.008)
• CVE-2017-17215 (T1219.001)
• CVE-2013-0074 (T1219.001)
• CVE-2012-0507 (T1219.001)
• CVE-2013-2551 (T1219.001)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1219.001)
• CVE-2015-0310 (T1219.001)
• CVE-2012-4681 (T1027.008)
• CVE-2014-1776 (T1219.001)
• CVE-2012-1876 (T1219.001)
• CVE-2015-0071 (T1219.001)
• CVE-2015-1761 (T1219.001)
• CVE-2014-8440 (T1219.001)
• CVE-2013-3660 (T1055.004)
• CVE-2010-0806 (T1219.001)
• CVE-2014-4148 (T1219.001)
• CVE-2011-3402 (T1219.001)
• CVE-2010-2883 (T1591.004)
• CVE-2014-7247 (T1219.001)
• CVE-2013-2678 (T1219.001)
• CVE-2010-0738 (T1102)
• CVE-2015-2426 (T1219.001)
• CVE-2008-1436 (T1583.006)
• CVE-2010-0232 (T1219.001)
• CVE-2010-4398 (T1219.001)
• CVE-2014-3393 (T1055.004)
• CVE-2012-6422 (T1055.004)
• CVE-2013-2595 (T1555.003)
• CVE-2014-3897 (T1219.001)
• CVE-2015-2387 (T1219.001)
• CVE-2011-1255 (T1219.001)
• CVE-2011-0611 (T1591.004)
• CVE-2013-5990 (T1219.001)
• CVE-2016-0189 (T1219.001)
• CVE-2017-7255 (T1584.008)
• CVE-2017-0143 (T1219.001)
• CVE-2026-0723 (T1219.001)
• CVE-2026-20127 (T1219.001)
• CVE-2015-3456 (T1555.003)
• CVE-2010-1553 (T1027.008)
• CVE-2016-1019 (T1219.001)
• CVE-2015-6034 (T1055.004)
• CVE-2017-0261 (T1055.004)
• CVE-2017-0262 (T1055.004)
• CVE-2013-3906 (T1140)
• CVE-2014-6352 (T1497.002)
• CVE-2015-0016 (T1219.001)
• CVE-2010-3333 (T1219.001)
• CVE-2014-0322 (T1219.001)
• CVE-2011-3544 (T1219.001)
• CVE-2014-7911 (T1027.008)
• CVE-2015-3636 (T1055.004)
• CVE-2013-6282 (T1219.001)
• CVE-2013-2465 (T1219.001)
• CVE-2014-8439 (T1219.001)
• CVE-2010-0188 (T1591.004)
• CVE-2014-0556 (T1219.001)
• CVE-2015-5560 (T1219.001)
• CVE-2015-0057 (T1219.001)
• CVE-2012-2539 (T1055.004)
• CVE-2014-9163 (T1219.001)
• CVE-2012-1723 (T1219.001)
• CVE-2010-1297 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2013-7331 (T1166)
• CVE-2015-2360 (T1219.001)
• CVE-2014-6324 (T1166)
• CVE-2013-0634 (T1140)
• CVE-2012-5054 (T1027.008)
• CVE-2013-0641 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2014-2273 (T1219.001)
• CVE-2015-4902 (T1219.001)
• CVE-2009-3129 (T1219.001)
• CVE-2010-2572 (T1219.001)
• CVE-2017-8570 (T1219.001)
• CVE-2012-0611 (T1055.004)
• CVE-2015-2419 (T1219.001)
• CVE-2016-4117 (T1219.001)
• CVE-2017-0001 (T1219.001)
• CVE-2025-13335 (T1027.008)
• CVE-2025-13927 (T1027.008)
• CVE-2025-54313 (T1027.008)
• CVE-2025-55183 (T1219.001)
• CVE-2025-66478 (T1219.001)
• CVE-2026-1102 (T1027.008)
• CVE-2012-0056 (T1055.004)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る