APT17 G0025

Overview 5 indicators

APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations.

Techniques 5 ATT&CK

Open in ATT&CK Navigator → or download the layer (5 techniques, layer 4.5)

• T1331 Obfuscate infrastructure
• T1341 Build social network persona
• T1342 Develop social network persona digital footprint
• T1583.006 Web Services
• T1585 Establish Accounts

Software 1

• BLACKCOFFEE

Principal sources 7 reports

Ranked by how many of this actor's indicators each report brought in.

• 3x.com/VirITeXplorer/status/1811743669579370989
• 3tgsoft.it/news/news_archivio.asp?id=1557&lang=eng
• 3virustotal.com/gui/file/28808164363d221ceb9cc48f7d9dbf…
• 3virustotal.com/gui/file/caeca1933efcd9ff28ac81663a304e…
• 3virustotal.com/gui/file/de19e0163af15585c305f845b90262…
• 2fireeye.com/blog/threat-research/2015/05/hiding_in_…
• 2github.com/fireeye/iocs/blob/master/APT17/7b9e87c5…

Related groups 2

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Leviathan G0065
  shares BLACKCOFFEE
• APT41 G0096
  shares BLACKCOFFEE

Timeline 5 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2024-07-12 3 domain2 yrs ago

   x.com/VirITeXplorer/status/1811743669579370989 · tgsoft.it/news/news_archivio.asp?id=1557&lang=eng · virustotal.com/gui/file/28808164363d221ceb9cc48f7d9dbf… · virustotal.com/gui/file/caeca1933efcd9ff28ac81663a304e… · virustotal.com/gui/file/de19e0163af15585c305f845b90262…

   equitaligaiustizia.it

   meeting.equitaligaiustizia.it

   themicrosoftnow.com

   copy batch

2. 2019-10-19 2 domain7 yrs ago

   fireeye.com/blog/threat-research/2015/05/hiding_in_… · github.com/fireeye/iocs/blob/master/APT17/7b9e87c5…

   news.jusched.net

   translate.wordraference.com

   copy batch

Further reading 9

• attack.mitre.org/groups/G0025
• www2.fireeye.com/rs/fireye/images/APT17_Report.pdf
• fireeye.com/blog/threat-research/2015/05/hiding_in_…
• github.com/fireeye/iocs/blob/master/APT17/7b9e87c5…
• x.com/VirITeXplorer/status/1811743669579370989
• virustotal.com/gui/file/caeca1933efcd9ff28ac81663a304e…
• tgsoft.it/news/news_archivio.asp?id=1557&lang=eng
• virustotal.com/gui/file/de19e0163af15585c305f845b90262…
• virustotal.com/gui/file/28808164363d221ceb9cc48f7d9dbf…