APT12 G0005

Overview 13 indicators

APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.

Techniques 5 ATT&CK

Open in ATT&CK Navigator → or download the layer (5 techniques, layer 4.5)

• T1102.002 Bidirectional Communication
• T1203 Exploitation for Client Execution
• T1204.002 Malicious File
• T1566.001 Spearphishing Attachment
• T1568.003 DNS Calculation

Software 3

• RIPTIDE
• Ixeshe
• HTRAN

Principal sources 7 reports

Ranked by how many of this actor's indicators each report brought in.

• 8bitofhex.com/2020/02/10/sapphire-mushroom-lnk-files
• 8otx.alienvault.com/pulse/5e447f6666b942ff1568cf2a
• 3twitter.com/ccxsaber/status/1189017890927726593
• 3virustotal.com/gui/file/a70d914bf690898d0737692735e99c…
• 3fireeye.com/blog/threat-research/2014/09/darwins-fa…
• 3github.com/fireeye/iocs/tree/master/APT12
• 3virustotal.com/gui/ip-address/141.108.2.157/relations

Related groups 1

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• APT30 G0013
  40% of published techniques in common

Timeline 13 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2020-02-13 1 ipv4, 6 url6 yrs ago

   bitofhex.com/2020/02/10/sapphire-mushroom-lnk-files · otx.alienvault.com/pulse/5e447f6666b942ff1568cf2a

   ipv4	178.128.110.214:8080
   url	http://128.199.73.43
   url	http://139.59.230.181
   url	http://159.65.127.93
   url	http://159.65.74.97
   url	http://188.226.144.42
   url	http://59.73.16.165

   copy batch

2. 2019-10-30 2 url7 yrs ago

   twitter.com/ccxsaber/status/1189017890927726593 · virustotal.com/gui/file/a70d914bf690898d0737692735e99c…

   http://139.59.101.236

   http://139.59.110.217

   copy batch

3. 2019-10-30 1 url7 yrs ago

   twitter.com/ccxsaber/status/1189017890927726593 · virustotal.com/gui/file/a70d914bf690898d0737692735e99c… · bitofhex.com/2020/02/10/sapphire-mushroom-lnk-files · otx.alienvault.com/pulse/5e447f6666b942ff1568cf2a

   http://139.59.226.29

   copy batch

4. 2019-10-19 2 domain, 1 url7 yrs ago

   fireeye.com/blog/threat-research/2014/09/darwins-fa… · github.com/fireeye/iocs/tree/master/APT12 · virustotal.com/gui/ip-address/141.108.2.157/relations

   domain	icc.ignorelist.com
   domain	video.csmcpr.com
   url	http://141.108.2.157

   copy batch

Further reading 9

• crowdstrike.com/blog/whois-numbered-panda
• attack.mitre.org/groups/G0005
• fireeye.com/blog/threat-research/2014/09/darwins-fa…
• virustotal.com/gui/file/a70d914bf690898d0737692735e99c…
• otx.alienvault.com/pulse/5e447f6666b942ff1568cf2a
• twitter.com/ccxsaber/status/1189017890927726593
• github.com/fireeye/iocs/tree/master/APT12
• virustotal.com/gui/ip-address/141.108.2.157/relations
• bitofhex.com/2020/02/10/sapphire-mushroom-lnk-files