H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[admin@338](https://attack.mitre.org/groups/G0018) is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as [PoisonIvy](https://attack.mitre.org/software/S0012), as well as some non-public backdoors. (Citation: FireEye admin@338)

19 recorded

Relationships

uses

Malware

uses

to Exploitation for Client Execution

Technique

uses

to File and Directory Discovery

Technique

uses

Tool

uses

to Local Account

Technique

uses

to Local Groups

Technique

uses

Malware

uses

to Malicious File

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Net

Tool

uses

Tool

uses

Malware

uses

to Spearphishing Attachment

Technique

uses

Tool

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

G0018

admin@338

—

FireEye admin@338

https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html