APT18 — APT Profile
APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical.Description reproduced from MITRE ATT&CK. © The MITRE Corporation, reproduced and distributed with permission.
Also tracked as
TG-0416, Dynamite Panda, Threat Group-0416, SCANDIUM, Wekby, G0026, Satin Typhoon
Tools & malware
- cmd Execution
- gh0st RAT Remote Access Trojan
- hcdLoader Loader
- HTTPBrowser Backdoor
- Pisloader Loader
- win.httpbrowser Backdoor
- win.roseam Backdoor
Vendor research
- Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems Carvey, H.
- Evasive Maneuvers by the Wekby group with custom ROP-packing and DNS covert channels Anomali
- Evasive Maneuvers ThreatStream Evasion Analysis
- Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems Dell