Tonto Team
IntrusionSet · ATTACK:enterprise:G0131
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0131",
"title": "Tonto Team",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0131",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--c5b81590-6814-4d2a-8baa-15c4b6c7f960",
"external_id": "G0131",
"domain": "enterprise",
"created": "2021-05-05T17:18:25.987Z",
"modified": "2026-07-31T18:48:18.168Z",
"version": "1.1",
"aliases": [
"Tonto Team",
"Earth Akhlut",
"BRONZE HUNTLEY",
"CactusPete",
"Karma Panda"
],
"tactics": [
],
"source_references": [
{
"source_name": "CactusPete"
},
{
"source_name": "Karma Panda"
},
{
"source_name": "BRONZE HUNTLEY"
},
{
"source_name": "Tonto Team"
},
{
"source_name": "Earth Akhlut"
},
{
"source_name": "TrendMicro Tonto Team October 2020",
"url": "https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"
},
{
"source_name": "CrowdStrike Manufacturing Threat July 2020",
"url": "https://www.crowdstrike.com/blog/adversaries-targeting-the-manufacturing-industry/"
},
{
"source_name": "ESET Exchange Mar 2021",
"url": "https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"
},
{
"source_name": "Talos Bisonal Mar 2020",
"url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
},
{
"source_name": "FireEye Chinese Espionage October 2019",
"url": "https://web.archive.org/web/20210308054208/https://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf"
},
{
"source_name": "Trend Micro HeartBeat Campaign January 2013",
"url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the-heartbeat-apt-campaign.pdf?"
},
{
"source_name": "ARS Technica China Hack SK April 2017",
"url": "https://arstechnica.com/information-technology/2017/04/researchers-claim-china-trying-to-hack-south-korea-missile-defense-efforts/"
},
{
"source_name": "Secureworks BRONZE HUNTLEY ",
"url": "https://www.secureworks.com/research/threat-profiles/bronze-huntley"
},
{
"source_name": "Talos Bisonal 10 Years March 2020",
"url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
},
{
"source_name": "Kaspersky CactusPete Aug 2020",
"url": "https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09673a33-d15e-460a-8980-55c67ee2bb19
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16e906b5-011b-476d-a00d-78e514e7354c
ESET Exchange Mar 2021ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1dcca5db-e03e-4330-8705-76aaedcf295f
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27f561f4-2631-4d82-b384-4e7a208ba484
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--420064ce-0bfd-4daa-9e4c-4b197634be19
Kaspersky CactusPete Aug 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1069.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--481fedde-ac7d-4d1b-a70a-b90ccd7acc52
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:S0268
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d2c0b15-fb83-4ec1-9e3c-3b0707519278
Kaspersky CactusPete Aug 2020 · Secureworks BRONZE HUNTLEY · Talos Bisonal Mar 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61ecf569-fd27-4c61-b1a9-a516fba16fac
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:S0596
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d4b2be8-946d-4ae7-a897-a5c92b00c512
Kaspersky CactusPete Aug 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e43af09-b4bb-46dc-87f3-e2b72e70b47a
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b6bebc2-caf5-4b22-847d-ef43881f9bd6
ESET Exchange Mar 2021ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:S0349
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a779fd0b-0fa0-4bcd-837f-4d3e12482ca1
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af7d7ff9-c74e-48da-9e6d-029161746afd
TrendMicro Tonto Team October 2020 · Talos Bisonal Mar 2020 · Talos Bisonal 10 Years March 2020 · Kaspersky CactusPete Aug 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba2d135f-cce4-4548-9298-ff8ed0d07dc7
TrendMicro Tonto Team October 2020 · Talos Bisonal Mar 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c20cc0d1-fe0b-4683-b6ed-bbb8736fe2ca
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbadd419-3f8c-485a-a458-09caed90d82e
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1210
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d393d40d-d18a-4d89-9cc8-b57d3afaa9bf
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d850b604-f451-4f58-aa8e-6fb2e2a307d0
ESET Exchange Mar 2021ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8d1b814-2a28-402f-ab3b-f64c6d9974ce
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb03b86a-02d4-4079-815f-46369026ad17
ESET Exchange Mar 2021ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:S0008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fcc1d2e7-f41d-4a06-85c6-f00ea602ddac
TrendMicro Tonto Team October 2020