aol.pm

APT18

IntrusionSet · ATTACK:enterprise:G0026

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0026",
  "title": "APT18",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0026",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--38fd6a28-3353-4f2b-bb2b-459fecd5c648",
  "external_id": "G0026",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:57.733Z",
  "modified": "2026-07-31T18:47:50.082Z",
  "version": "2.2",
  "aliases": [
    "APT18",
    "TG-0416",
    "Dynamite Panda",
    "Threat Group-0416"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Threat Group-0416"
    },
    {
      "source_name": "APT18"
    },
    {
      "source_name": "TG-0416"
    },
    {
      "source_name": "Dynamite Panda"
    },
    {
      "source_name": "Dell Lateral Movement",
      "url": "http://www.secureworks.com/resources/blog/where-you-at-indicators-of-lateral-movement-using-at-exe-on-windows-7-systems/"
    },
    {
      "source_name": "Anomali Evasive Maneuvers July 2015",
      "url": "https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop"
    },
    {
      "source_name": "ThreatStream Evasion Analysis",
      "url": "https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop"
    }
  ]
}

Explicit source assertions (17)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ac5bace-cdc2-4a1b-abad-d30ca0ed7f45

RSA2017 Detect and Respond Adair

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23bd8e78-b20d-41bd-acfb-5ed356b327b2

PaloAlto DNS Requests May 2016

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b521f87-a77d-4c8d-8ab8-ffc6dbc3d62e

RSA2017 Detect and Respond Adair

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6175bbbe-1bc1-4562-8c5f-9e437348636a

Dell Lateral Movement

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1053.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67f19627-27a5-4898-bab5-7b235aa4ad77

Dell Lateral Movement

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:S0071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7dc4c8b9-a380-4dc0-9973-a8a2f8d0175c

Dell Lateral Movement · ThreatStream Evasion Analysis

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80c071f7-123e-468f-800d-726a1d3e4144

RSA2017 Detect and Respond Adair

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--882c68e3-5f01-4438-a430-ff22692d8910

PaloAlto DNS Requests May 2016

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:S0106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89c6bcd7-e330-4902-8296-0918923d6573

Dell Lateral Movement

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:S0124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95842c88-c596-44c7-a16e-40d98e2457cc

Palo Alto DNS Requests

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1cf88bc-6229-4d62-86f5-36aa0e7bd21a

PaloAlto DNS Requests May 2016

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c47e35e1-cf8a-4c2b-b63d-25b37a008226

PaloAlto DNS Requests May 2016

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7d7b5e5-aceb-473b-aeaa-f1287d8d0542

PaloAlto DNS Requests May 2016

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3417dc3-f784-4306-8466-65a0067b63f1

PaloAlto DNS Requests May 2016

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e453cf75-0df0-45e5-a5ce-e0984bf864f8

PaloAlto DNS Requests May 2016 · Anomali Evasive Maneuvers July 2015

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e47f03aa-09b3-45a2-927d-b2cd96e7c444

Anomali Evasive Maneuvers July 2015 · PaloAlto DNS Requests May 2016

ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:S0070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9612cb1-79a5-4987-aa83-b84aa7fa050f

RSA2017 Detect and Respond Adair

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.