Threat intelligence / Group

APT19

[APT19](https://attack.mitre.org/groups/G0073) is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track [APT19](https://attack.mitre.org/groups/G0073) and [Deep Panda](https://attack.mitre.org/groups/G0009) as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016) (Citation: FireEye APT Groups) (Citation: Unit 42 C0d0so0 Jan 2016)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[APT19](https://attack.mitre.org/groups/G0073) is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track [APT19](https://attack.mitre.org/groups/G0073) and [Deep Panda](https://attack.mitre.org/groups/G0009) as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016) (Citation: FireEye APT Groups) (Citation: Unit 42 C0d0so0 Jan 2016)

23 recorded

Relationships

uses

to Cobalt Strike

Malware

uses

to Command and Scripting Interpreter

Technique

uses

to Command Obfuscation

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Drive-by Compromise

Technique

uses

Tool

uses

to Encrypted/Encoded File

Technique

uses

to Hidden Window

Technique

uses

to Malicious File

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

Technique

uses

to Spearphishing Attachment

Technique

uses

to Standard Encoding

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

uses

to Windows Service

Technique

11 external

References

mitre-attack

G0073

Sunshop Group

—

Codoso Team

—

APT19

—

Codoso

—

C0d0so0

—

FireEye APT19

https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html

Dark Reading Codoso Feb 2015

https://www.darkreading.com/attacks-breaches/chinese-hacking-group-codoso-team-uses-forbescom-as-watering-hole-/d/d-id/1319059

FireEye APT Groups

https://www.fireeye.com/current-threats/apt-groups.html#apt19

Unit 42 C0d0so0 Jan 2016

https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/

ICIT China's Espionage Jul 2016

https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/