APT30 G0013

Overview 25 indicators

APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.

Techniques 2 ATT&CK

Open in ATT&CK Navigator → or download the layer (2 techniques, layer 4.5)

• T1204.002 Malicious File
• T1566.001 Spearphishing Attachment

Software 5

• SHIPSHAPE
• BACKSPACE
• NETEAGLE
• SPACESHIP
• FLASHFLOOD

Principal sources 5 reports

Ranked by how many of this actor's indicators each report brought in.

• 12media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/200…
• 9twitter.com/3XS0/status/1253426730217291778 (# Lecn…
• 9ptsecurity.com/ww-en/analytics/pt-esc-threat-intellige…
• 4twitter.com/Vishnyak0v/status/1252495730486456321
• 4virustotal.com/gui/ip-address/103.233.10.152/relations

Related groups 1

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• APT12 G0005
  40% of published techniques in common

Timeline 25 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2020-06-19 1 domain, 1 ipv4, 2 url_path6 yrs ago

   twitter.com/3XS0/status/1253426730217291778 (# Lecn… · ptsecurity.com/ww-en/analytics/pt-esc-threat-intellige…

   domain	techmicrost.com
   ipv4	172.247.197.189:443
   url_path	/clntcmd.php
   url_path	/clntsignin.php

   copy batch

2. 2020-04-23 2 ipv4, 1 url6 yrs ago

   twitter.com/Vishnyak0v/status/1252495730486456321 · virustotal.com/gui/ip-address/103.233.10.152/relations

   ipv4	103.233.10.152:4433
   ipv4	103.233.10.152:8080
   url	http://103.233.10.152

   copy batch

3. 2020-04-23 2 domain6 yrs ago

   twitter.com/3XS0/status/1253426730217291778 (# Lecn… · ptsecurity.com/ww-en/analytics/pt-esc-threat-intellige…

   gordeneyes.com

   kabadefender.com

   copy batch

4. 2020-04-21 1 ipv46 yrs ago

   twitter.com/Vishnyak0v/status/1252495730486456321 · virustotal.com/gui/ip-address/103.233.10.152/relations

   103.233.10.152:3306

   copy batch

5. 2019-09-22 12 domain7 yrs ago

   media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/200…

   appsecnic.com

   aseanm.com

   autoapec.com

   bigfixtools.com

   bluesixnine.com

   cbkjdxf.com

   creammemory.com

   iapfreecenter.com

   km-nyc.com

   km153.com

   lisword.com

   newpresses.com

   copy batch

6. 2019-09-22 3 url_path7 yrs ago

   twitter.com/3XS0/status/1253426730217291778 (# Lecn… · ptsecurity.com/ww-en/analytics/pt-esc-threat-intellige…

   /ForZRLnk1z/

   /ForZRLnk3z/

   /Lnk1z/

   copy batch

Further reading 7

• attack.mitre.org/groups/G0013
• media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/200…
• securelist.com/the-naikon-apt/69953
• ptsecurity.com/ww-en/analytics/pt-esc-threat-intellige…
• twitter.com/Vishnyak0v/status/1252495730486456321
• twitter.com/3XS0/status/1253426730217291778 (# Lecn…
• virustotal.com/gui/ip-address/103.233.10.152/relations