aol.pm

APT19

IntrusionSet · ATTACK:enterprise:G0073

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0073",
  "title": "APT19",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0073",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--fe8796a4-2a02-41a0-9d27-7aa1e995feb6",
  "external_id": "G0073",
  "domain": "enterprise",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2026-07-31T18:48:29.759Z",
  "version": "1.6",
  "aliases": [
    "APT19",
    "Codoso",
    "C0d0so0",
    "Codoso Team",
    "Sunshop Group"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Sunshop Group"
    },
    {
      "source_name": "Codoso Team"
    },
    {
      "source_name": "APT19"
    },
    {
      "source_name": "Codoso"
    },
    {
      "source_name": "C0d0so0"
    },
    {
      "source_name": "FireEye APT19",
      "url": "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
    },
    {
      "source_name": "Dark Reading Codoso Feb 2015",
      "url": "https://www.darkreading.com/attacks-breaches/chinese-hacking-group-codoso-team-uses-forbescom-as-watering-hole-/d/d-id/1319059"
    },
    {
      "source_name": "FireEye APT Groups",
      "url": "https://www.fireeye.com/current-threats/apt-groups.html#apt19"
    },
    {
      "source_name": "Unit 42 C0d0so0 Jan 2016",
      "url": "https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"
    },
    {
      "source_name": "ICIT China's Espionage Jul 2016",
      "url": "https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/"
    }
  ]
}

Explicit source assertions (23)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04558d61-aa04-46b5-a65f-921011ac9621

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1219cbd2-26b8-4a2e-bbf1-477afc396203

FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e6e8722-d09d-402e-9ea8-ccf8412339d0

FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--322703cc-c8f9-4046-8a61-e165a2d11bc7

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331ebf73-af72-4121-815a-d10392ac75ab

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bcfc38f-5fe8-4c66-8352-d3ba71c4f3ec

FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45f35ec0-73a8-42a6-b879-d800d27211c8

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--478f7f77-6b6b-4949-ac87-f28419b5e2ab

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4999a323-b025-4a1d-8c80-5ae36b2f5a0d

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a6c44ec-a1de-4fbc-88ef-d3003137a2fc

FireEye APT19 · Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f2e62d0-5345-45dc-9e9d-46bb11c5f35d

FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59cccc5a-f6f9-4a2f-aa74-2b7235b1855c

FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f830006-234e-44d1-9441-1aca7990006c

FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--818b440b-075d-483d-83ff-9991a78e25f4

FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89b157e1-3972-421e-87c9-f9e83b26ec90

NCSC Joint Report Public Tools

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b033e131-e448-46c6-815b-b86e4bd6d638

FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3d9182c-178b-4d8d-91d8-f4d1313738bb

FireEye APT19 · Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1b46f3e-b25c-43c0-9ab2-ef6e5ff8270c

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6b509c8-0e00-48ac-b76d-f42d18a0ae51

NCSC Joint Report Public Tools · FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f35a3ca7-b916-4bc2-a493-613196b5d41e

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1218.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f832e042-6859-4415-9b6c-4e093dc955ec

FireEye APT19

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f84b2658-a891-45a8-93ff-14dc0a86df10

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd78292b-d484-4d08-baa4-f6b58bb63622

FireEye APT19

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.