Threat intelligence / Group

Confucius

[Confucius](https://attack.mitre.org/groups/G0142) is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between [Confucius](https://attack.mitre.org/groups/G0142) and [Patchwork](https://attack.mitre.org/groups/G0040), particularly in their respective custom malware code and targets.(Citation: TrendMicro Confucius APT Feb 2018)(Citation: TrendMicro Confucius APT Aug 2021)(Citation: Uptycs Confucius APT Jan 2021)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Confucius](https://attack.mitre.org/groups/G0142) is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between [Confucius](https://attack.mitre.org/groups/G0142) and [Patchwork](https://attack.mitre.org/groups/G0040), particularly in their respective custom malware code and targets.(Citation: TrendMicro Confucius APT Feb 2018)(Citation: TrendMicro Confucius APT Aug 2021)(Citation: Uptycs Confucius APT Jan 2021)

20 recorded

Relationships

uses

to Automated Collection

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to Exploitation for Client Execution

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

Technique

uses

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Scheduled Task

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Template Injection

Technique

uses

to Visual Basic

Technique

uses

Malware

uses

to Web Protocols

Technique

uses

to Web Services

Technique

4 external

References

mitre-attack

G0142

TrendMicro Confucius APT Feb 2018

https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html

TrendMicro Confucius APT Aug 2021

https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html

Uptycs Confucius APT Jan 2021

https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat