Threat intelligence / Group

APT5

[APT5](https://attack.mitre.org/groups/G1023) is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. [APT5](https://attack.mitre.org/groups/G1023) has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.(Citation: NSA APT5 Citrix Threat Hunting December 2022)(Citation: Microsoft East Asia Threats September 2023)(Citation: Mandiant Pulse Secure Zero-Day April 2021)(Citation: Mandiant Pulse Secure Update May 2021)(Citation: FireEye Southeast Asia Threat Landscape March 2015)(Citation: Mandiant Advanced Persistent Threats)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

43 recorded

Relationships

attributed-to

from SPACEHOP Activity

Campaign

uses

to Additional Local or Domain Groups

Technique

uses

to Archive via Utility

Technique

uses

to Botnet

Technique

uses

to Clear Command History

Technique

uses

to Cloud Accounts

Technique

uses

to Compromise Host Software Binary

Technique

uses

to Cron

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domain Accounts

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to gh0st RAT

Malware

uses

to Indicator Removal

Technique

uses

to Keylogging

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to Log Enumeration

Technique

uses

to LSASS Memory

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mimikatz

Tool

uses

to Net

Tool

uses

to netstat

Tool

uses

to PACEMAKER

Malware

uses

to PcShare

Tool

uses

to PoisonIvy

Malware

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

to PULSECHECK

Malware

uses

to RAPIDPULSE

Malware

uses

to Remote Desktop Protocol

Technique

uses

to Security Account Manager

Technique

uses

to Skeleton Key

Malware

uses

to SLIGHTPULSE

Malware

uses

to SLOWPULSE

Malware

uses

to SSH

Technique

uses

to System Network Connections Discovery

Technique

uses

to Tasklist

Tool

uses

to Timestomp

Technique

uses

to Web Shell

Technique

uses

to Windows Command Shell

Technique

14 external

References

mitre-attack

G1023

open

Mulberry Typhoon

—

MANGANESE

—

Keyhole Panda

—

UNC2630

—

BRONZE FLEETWOOD

—

FireEye Southeast Asia Threat Landscape March 2015

https://web.archive.org/web/20220122121143/https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-southeast-asia-threat-landscape.pdf

open

Mandiant Advanced Persistent Threats

https://www.mandiant.com/resources/insights/apt-groups

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open

Microsoft East Asia Threats September 2023

https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW

open

NSA APT5 Citrix Threat Hunting December 2022

https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF

open

Mandiant Pulse Secure Zero-Day April 2021

https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day

open

Mandiant Pulse Secure Update May 2021

https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices

open

Secureworks BRONZE FLEETWOOD Profile

https://www.secureworks.com/research/threat-profiles/bronze-fleetwood

open