Overview 246 indicators
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).
| domain | 232 | G0131-domain.txt |
| ipv4 | 5 | G0131.json |
| url_path | 5 | G0131.json |
| url | 4 | G0131.json |
Techniques 15 ATT&CK
Open in ATT&CK Navigator → or download the layer (15 techniques, layer 4.5)
- T1003 OS Credential Dumping
- T1056.001 Keylogging
- T1059.001 PowerShell
- T1059.006 Python
- T1068 Exploitation for Privilege Escalation
- T1069.001 Local Groups
- T1090.002 External Proxy
- T1105 Ingress Tool Transfer
- T1135 Network Share Discovery
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1210 Exploitation of Remote Services
- T1505.003 Web Shell
- T1566.001 Spearphishing Attachment
- T1574.001 DLL
Software 6
Principal sources 53 reports
Ranked by how many of this actor's indicators each report brought in.
- 72twitter.com/h2jazi/status/1555611666343133185
- 72asec.ahnlab.com/ko/33948/ (Korean)
- 72go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf (# TAG-…
- 72virustotal.com/gui/ip-address/92.38.135.212/relations
- 72otx.alienvault.com/pulse/62729ce9e66ec5fd15790d3a
- 72virustotal.com/gui/file/56f714b1832d0eb58a688c843d4176…
- 41vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
- 31vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
Related groups 1
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 246 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
twitter.com/h2jazi/status/1555611666343133185 · asec.ahnlab.com/ko/33948/ (Korean) · go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf (# TAG-… · virustotal.com/gui/ip-address/92.38.135.212/relations · otx.alienvault.com/pulse/62729ce9e66ec5fd15790d3a · virustotal.com/gui/file/56f714b1832d0eb58a688c843d4176…
alleyk.onthewifi.com anrnet.servegame.com asheepa.sytes.net attachdaum.servecounterstrike.com attachmaildaum.serveblog.net attachmaildaum.servecounterstrike.com bizmeka.viewdns.net bucketnec.bounceme.net chsoun.serveftp.com daecheol.myvnc.com eburim.viewdns.net eduin21.zapto.org elecinfonec.servehalflife.com foodlab.hopto.org formsgle.freedynamicdns.org fresh.servepics.com global.freedynamicdns.net global.freedynamicdns.org hamonsoft.serveblog.net hanseo1.hopto.org hometax.onthewifi.com hwarang.myddns.me jaminss.viewdns.net janara.freedynamicdns.org jeoash.servemp3.com jstreco.myftp.biz kanager.bounceme.net kcgselect.servehalflife.com kjmacgk.ddnsking.com kookmina.servecounterstrike.com ksd22.myddns.me kumohhic.viewdns.net kybook.viewdns.net leader.gotdns.ch likms.hopto.org logindaums.ddnsking.com loginsdaum.viewdns.net mafolog.serveminecraft.net mailplug.ddnsking.com minjoo2.servehttp.com mintaek.bounceme.net munjanara.servehttp.com necgo.serveblog.net pattern.webhop.me pixoneer.myvnc.com plomacy.ddnsking.com proeso.servehttp.com prparty.webhop.me puacgo1.servemp3.com saevit.servebeer.com safety.viewdns.net samgiblue.servegame.com sarang.serveminecraft.net satreci.bounceme.net sejonglog.hopto.org signga.redirectme.net steering.viewdns.net stjpmsko.serveblog.net surveymonkey.myddns.me themiujoo.viewdns.net tsuago.servehalflife.com tsuagos.servehalflife.com unipedu.servebeer.com visdpaka.servemp3.com visual.webhop.me wwl1764.ddnsking.com -
asec.ahnlab.com/en/51746 · otx.alienvault.com/pulse/644fbd07a98ffc006a3e71cc
153.234.77.155:8080 45.133.194.135:8080 -
asec.ahnlab.com/en/51746 · otx.alienvault.com/pulse/644fbd07a98ffc006a3e71cc · twitter.com/h2jazi/status/1555611666343133185 · asec.ahnlab.com/ko/33948/ (Korean) · go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf (# TAG-… · virustotal.com/gui/ip-address/92.38.135.212/relations · otx.alienvault.com/pulse/62729ce9e66ec5fd15790d3a · virustotal.com/gui/file/56f714b1832d0eb58a688c843d4176…
hairouni.serveblog.net -
twitter.com/h2jazi/status/1537536029250490382 · twitter.com/nao_sec/status/1538857219025817605 · twitter.com/GroupIB_TI/status/1625050738933071873 · sentinelone.com/labs/targets-of-interest-russian-organi… · group-ib.com/blog/tonto-team · virustotal.com/gui/ip-address/137.220.176.165/relations · virustotal.com/gui/ip-address/64.233.167.99/relations · virustotal.com/gui/file/c7018ee3783f4b2fb19fedc78c5958… · virustotal.com/gui/file/7944fa9cbfef2c7d652f032edc159a… · virustotal.com/gui/file/ba2c89192643f05e64f49b5cb3513a…
ipv4 103.85.20.194:443 ipv4 137.220.176.165:443 url http://137.220.176.165 url_path /ru/news/index.php?strPageID= url_path /ru/order/index.php?strPageID= url_path /siteFiles/index.php?strPageID= url_path /xhome.native.page/datareader.php -
twitter.com/h2jazi/status/1555611666343133185 · asec.ahnlab.com/ko/33948/ (Korean) · go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf (# TAG-… · virustotal.com/gui/ip-address/92.38.135.212/relations · otx.alienvault.com/pulse/62729ce9e66ec5fd15790d3a · virustotal.com/gui/file/56f714b1832d0eb58a688c843d4176…
ckstar.zapto.org -
twitter.com/h2jazi/status/1537536029250490382 · twitter.com/nao_sec/status/1538857219025817605 · twitter.com/GroupIB_TI/status/1625050738933071873 · sentinelone.com/labs/targets-of-interest-russian-organi… · group-ib.com/blog/tonto-team · virustotal.com/gui/ip-address/137.220.176.165/relations · virustotal.com/gui/ip-address/64.233.167.99/relations · virustotal.com/gui/file/c7018ee3783f4b2fb19fedc78c5958… · virustotal.com/gui/file/7944fa9cbfef2c7d652f032edc159a… · virustotal.com/gui/file/ba2c89192643f05e64f49b5cb3513a…
instructor.giize.com news.wooordhunts.com wooordhunts.com -
twitter.com/h2jazi/status/1538914969495928838 · virustotal.com/gui/file/a56003dc199224113e9c85b0edb219…
ramblercloud.com -
twitter.com/h2jazi/status/1537536029250490382 · twitter.com/nao_sec/status/1538857219025817605 · twitter.com/GroupIB_TI/status/1625050738933071873 · sentinelone.com/labs/targets-of-interest-russian-organi… · group-ib.com/blog/tonto-team · virustotal.com/gui/ip-address/137.220.176.165/relations · virustotal.com/gui/ip-address/64.233.167.99/relations · virustotal.com/gui/file/c7018ee3783f4b2fb19fedc78c5958… · virustotal.com/gui/file/7944fa9cbfef2c7d652f032edc159a… · virustotal.com/gui/file/ba2c89192643f05e64f49b5cb3513a…
lingrevelat.com supportteam.lingrevelat.com thresident.com upportteam.lingrevelat.com -
twitter.com/h2jazi/status/1555611666343133185 · asec.ahnlab.com/ko/33948/ (Korean) · go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf (# TAG-… · virustotal.com/gui/ip-address/92.38.135.212/relations · otx.alienvault.com/pulse/62729ce9e66ec5fd15790d3a · virustotal.com/gui/file/56f714b1832d0eb58a688c843d4176…
finance.my-homeip.com formsgle.freedynamicdns.net harvest.my-homeip.net skparty.myonlineportal.org -
virustotal.com/gui/file/b1ee236a36f04ca43d3c8e3ad6255b…
103.231.14.134:443 -
twitter.com/8th_grey_owl/status/1412583883137110020 · virustotal.com/gui/ip-address/67.205.76.102/relations · virustotal.com/gui/file/677e697644f7c0d83a30e2daaddb93…
bitsshare.com myblogcloud.com myforumcloud.com mynotecloud.com myschedulecloud.com -
virustotal.com/gui/file/beb8c6dce6088512ef28a4431ad57f… · virustotal.com/gui/file/d5da23df6242a672e8fd520db6d919… · virustotal.com/gui/file/b6584fe5d4e1c8fbbae108e79e87f8…
search.system-ns.net ww1.system-ns.net ww12.system-ns.net ww7.system-ns.net -
virustotal.com/gui/file/dc9645b7ed1e88442b74be13298afa…
comunity.system-ns.org -
virustotal.com/gui/file/d181dc5c6806077378d6951cb3ec67…
jobnate.system-ns.org -
virustotal.com/gui/file/969bd3755589e616b8bcf553c7fbad…
gomalove.system-ns.org -
virustotal.com/gui/file/beb8c6dce6088512ef28a4431ad57f… · virustotal.com/gui/file/d5da23df6242a672e8fd520db6d919… · virustotal.com/gui/file/b6584fe5d4e1c8fbbae108e79e87f8…
/krsy/a.asp -
vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
acivo.serveblog.net adobe-online.com adoberevise.com anna111.epac.to babyhome.lflink.com babyhome.mefound.com bluesky.jkub.com chrgeom.system-ns.net creepbeforeyouwalk.com doctor-s.dhcp.biz doctor-s.edns.biz finance.my-homeip.net gedadye.com home-blog.dynssl.com hotadobes.com kakao.myonlineportal.org lovehome.zzux.com luckybabys.dnset.com lucylucy.dynamic-dns.net media.myonlineportal.net missca.justdied.com movie2014.passas.us music2014.passas.us officerevise.com online-offices.com sdkpress.com tcostream.dhcp.biz tradekorea.system-ns.org tvpot.system-ns.org webtvpot.system-ns.org wikipedia.dnset.com -
vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
abulasha-banama.onedumb.com best.indoingwulearn.com connts.zzux.com fdods.my03.com fdtg.dynamic-dns.net fose.mos2ioa.com gotomail.ddns.net gtfd.mos2ioa.com hellomydog.compress.to hellomydog.mrface.com indoingwulearn.com lucylucy.ninth.biz misova.mos2ioa.com mos2ioa.com mosclar.mrbonus.com mvp.onedumb.com nmbpo.com relerc.ddns.net shuudans.com svyaztu.indoingwulearn.com tsahimt.com tsowe.2waky.com tube.compress.to vip.fartit.com vip.onedumb.com yandexmedia.serveuser.com -
vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
adobeupdata.zzux.com adobeupdate.dns04.com baekmaonline.com beatidc.com bravojack.justdied.com chromeupdate.lflink.com cnnmirror.com gmailserverweb.com havsar.com lubny23.com maintenance.baekmaonline.com news-serverweb.com prettyrose.justdied.com shop.beatidc.com store.beatidc.com support.baekmaonline.com -
vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
bbc.xxxy.info daummail.otzo.com ftp.sshdd.toythieves.com golfmsdn.com manage.yesterdayko.com organisea.rutrackerbit.com rutrackerbit.com search.yesterdayko.com sshdd.toythieves.com tknow.squirly.info yesterdayko.com -
vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
bluecat.mefound.com developman.ocry.com free2015.longmusic.com freemusic.zzux.com gmarket.system-ns.org redfish.misecure.com serviceonline.otzo.com videoservice.dnset.com -
vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
daum.xxuz.com facegooglebook.mrbasic.com msdn.ezua.com yandex.mrface.com -
ptsecurity.com/ru-ru/research/pt-esc-threat-intelligen…
g00gleru.wikaba.com -
securelist.com/cactuspete-apt-groups-updated-bisonal-b…
http://154.223.175.115/chapter1/user.html/ http://154.95.17.145/chapter1/user.html/ -
securitykitten.github.io/2014/11/25/curious-korlia.html · virustotal.com/gui/ip-address/61.90.202.198/relations · virustotal.com/gui/file/dc9f17c87397428089e70aeea5af47…
domain japanbaba.myfw.us domain koreamama.myfw.us url http://61.90.202.198 -
virustotal.com/gui/file/98c59d682da617f993f3d57bb9e3ff…
nancyxi.gotdns.org nothree.myfw.us -
virustotal.com/gui/file/83231d8e25f1c8d74aa9eb07f18dca…
shinkhw.organiccrap.com -
virustotal.com/gui/file/80f8c3c2f44dc514500b49adc31b9b…
webmaff.dns05.com -
virustotal.com/gui/file/13c5eb2c8deaf1b4b51eac782cc1f1…
shinkhw.myfw.us -
twitter.com/nao_sec/status/1273209439764406272 · app.any.run/tasks/4c751168-358a-49c9-b751-e5b4aad9b… · vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
offices-update.com -
asec.ahnlab.com/1298 · twitter.com/vigilantbeluga/status/12354966298110771… · otx.alienvault.com/pulse/5e612f6d1dadda20c4314b21
imbc.onthewifi.com -
blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html
0906.toh.info 21kmg.my-homeip.net agent.my-homeip.net amanser951.otzo.com applejp.myfw.us dds.walshdavis.com dnsdns1.passas.us emsit.serveirc.com faceto.uglyas.com hansun.serveblog.net indbaba.myfw.us kazama.myfw.us kfsinfo.byinter.net kreng.bounceme.net mycount.mrslove.com navego.serveblog.net nayana.adultdns.net shinkhek.myfw.us since.qpoe.com usababa.myfw.us v3net.rr.nu wew.mymom.info -
researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-att… · blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html
hosting.tempors.com -
docs.google.com/spreadsheets/d/1lDzylI6Jymz7EE0agRVUsL3… · vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
uacmoscow.com -
docs.google.com/spreadsheets/d/1lDzylI6Jymz7EE0agRVUsL3… · vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
svyaztulaya.dynamic-dns.net -
twitter.com/Vishnyak0v/status/1216689015035977730 · blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html
etude.servemp3.com -
vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
stcinet.com stcnet.ddns.net -
twitter.com/blu3_team/status/951647866531057665 · vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
nubpubwizard.jetos.com worktrs.wikaba.com -
researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-att… · blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html
euiro8966.organiccrap.com games.my-homeip.com jennifer998.lookin.at kted56erhg.dynssl.com
Further reading 61
- arstechnica.com/information-technology/2017/04/research…
- attack.mitre.org/groups/G0131
- blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html
- securelist.com/cactuspete-apt-groups-updated-bisonal-b…
- vb2020.vblocalhost.com/uploads/VB2020-06.pdf
- web.archive.org/web/20210308054208/https://www.fireeye.…
- crowdstrike.com/blog/adversaries-targeting-the-manufact…
- secureworks.com/research/threat-profiles/bronze-huntley
- trendmicro.de/cloud-content/us/pdfs/security-intellig…
- welivesecurity.com/2021/03/10/exchange-servers-under-siege…
- docs.google.com/spreadsheets/d/1lDzylI6Jymz7EE0agRVUsL3…
- virustotal.com/gui/file/677e697644f7c0d83a30e2daaddb93…
- virustotal.com/gui/file/80f8c3c2f44dc514500b49adc31b9b…
- ptsecurity.com/ru-ru/research/pt-esc-threat-intelligen…
- researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-att…
- virustotal.com/gui/file/b1ee236a36f04ca43d3c8e3ad6255b…
- virustotal.com/gui/file/b6584fe5d4e1c8fbbae108e79e87f8…
- twitter.com/h2jazi/status/1555611666343133185
- otx.alienvault.com/pulse/644fbd07a98ffc006a3e71cc
- virustotal.com/gui/file/98c59d682da617f993f3d57bb9e3ff…
- otx.alienvault.com/pulse/62729ce9e66ec5fd15790d3a
- virustotal.com/gui/ip-address/61.90.202.198/relations
- twitter.com/vigilantbeluga/status/12354966298110771…
- vblocalhost.com/uploads/VB2020-Lunghi-Horejsi.pdf (# Cl…
- virustotal.com/gui/ip-address/64.233.167.99/relations
- otx.alienvault.com/pulse/5e612f6d1dadda20c4314b21
- go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf (# TAG-…
- twitter.com/h2jazi/status/1537536029250490382
- twitter.com/Vishnyak0v/status/1216689015035977730
- asec.ahnlab.com/ko/33948/ (Korean)
- group-ib.com/blog/tonto-team
- virustotal.com/gui/file/ba2c89192643f05e64f49b5cb3513a…
- twitter.com/nao_sec/status/1538857219025817605
- virustotal.com/gui/file/7944fa9cbfef2c7d652f032edc159a…
- virustotal.com/gui/ip-address/67.205.76.102/relations
- virustotal.com/gui/file/969bd3755589e616b8bcf553c7fbad…
- asec.ahnlab.com/en/51746
- app.any.run/tasks/4c751168-358a-49c9-b751-e5b4aad9b…
- twitter.com/h2jazi/status/1538914969495928838
- virustotal.com/gui/file/dc9f17c87397428089e70aeea5af47…
21 more, and the report behind every indicator, in G0131.json.