Tonto Team — APT Profile
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).Also tracked as
Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda, Copper Typhoon
Tools & malware
- Bisonal Backdoor
- gsecdump Credential Harvesting
- LaZagne Credential Harvesting
- Mimikatz Credential Harvesting
- NBTscan Network Reconnaissance
- ShadowPad Backdoor
- win.8t_dropper Loader
- win.calmthorn Backdoor
- win.dexbia Backdoor
- win.korlia Backdoor
- win.quickmute Backdoor
- win.shadowpad Backdoor
- win.typehash Backdoor
Vendor research
- Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure TrendMicro
- Manufacturing Industry in the Adversaries’ Crosshairs Crowdstrike
- Exchange servers under siege from at least 10 APT groups ESET
- Bisonal: 10 years of play Talos
- Achievement Unlocked - Chinese Cyber Espionage Evolves to Support Higher Level Missions FireEye
- The HeartBeat APT Campaign Trend Micro
- Researchers claim China trying to hack South Korea missile defense efforts Ars Technica
- BRONZE HUNTLEY Threat Profile Secureworks
- CactusPete APT group’s updated Bisonal backdoor Kaspersky