APT5
IntrusionSet · ATTACK:enterprise:G1023
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1023",
"title": "APT5",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1023",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--c1aab4c9-4c34-4f4f-8541-d529e46a07f9",
"external_id": "G1023",
"domain": "enterprise",
"created": "2024-02-05T19:27:35.655Z",
"modified": "2026-07-31T18:48:16.107Z",
"version": "1.1",
"aliases": [
"APT5",
"Mulberry Typhoon",
"MANGANESE",
"BRONZE FLEETWOOD",
"Keyhole Panda",
"UNC2630"
],
"tactics": [
],
"source_references": [
{
"source_name": "Mulberry Typhoon"
},
{
"source_name": "MANGANESE"
},
{
"source_name": "Keyhole Panda"
},
{
"source_name": "UNC2630"
},
{
"source_name": "BRONZE FLEETWOOD"
},
{
"source_name": "FireEye Southeast Asia Threat Landscape March 2015",
"url": "https://web.archive.org/web/20220122121143/https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-southeast-asia-threat-landscape.pdf"
},
{
"source_name": "Mandiant Advanced Persistent Threats",
"url": "https://www.mandiant.com/resources/insights/apt-groups"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft East Asia Threats September 2023",
"url": "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW"
},
{
"source_name": "NSA APT5 Citrix Threat Hunting December 2022",
"url": "https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF"
},
{
"source_name": "Mandiant Pulse Secure Zero-Day April 2021",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
},
{
"source_name": "Mandiant Pulse Secure Update May 2021",
"url": "https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"
},
{
"source_name": "Secureworks BRONZE FLEETWOOD Profile",
"url": "https://www.secureworks.com/research/threat-profiles/bronze-fleetwood"
}
]
}Explicit source assertions (43)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0345ec62-657e-4673-89a1-d17e85f5dab0
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0782e7d8-3df6-4eb4-99a9-3d3a74c7752c
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d9b3bc8-8aff-4556-9a5f-1d4f91eb93b9
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1070.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--172391d2-7207-42b0-987b-8760bc58e35a
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17efaef0-499d-4c09-a4c9-32a22edae6db
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f409bb6-2dc3-4e4b-901b-b177d4d03fd6
Mandiant Advanced Persistent ThreatsATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1654
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35423c2b-7b57-423b-8573-6f6cf2cd22ec
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37915015-f4c2-48be-9a98-e846c37baedc
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cca00d1-fe7a-4546-bc70-e0f3482cd986
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1583.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44015f18-b15c-4816-8068-9420915527ce
ORB MandiantATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S1050
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44fd01db-6dc1-4d7c-92e3-52a0af9f54f8
Secureworks BRONZE FLEETWOOD ProfileATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4df03f98-3c25-4772-8be5-cc1aaeff1cc9
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51b09cc3-d54b-4b22-a354-0e2094851321
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f14394c-2b44-4187-a2a4-7ccb4109fdb1
Mandiant Pulse Secure Zero-Day April 2021 · Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61c71926-6802-44e8-9918-d2b3a8b19f94
FireEye Southeast Asia Threat Landscape March 2015 · Mandiant Advanced Persistent ThreatsATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6370e4b2-a26e-489f-a444-3d32991c0783
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63aca7d8-64dc-412b-a8ab-8af712fd4d82
Mandiant Pulse Secure Zero-Day April 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d3e3456-40c8-4079-8a40-459d051e354e
Mandiant Pulse Secure Zero-Day April 2021 · Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--705fe2ec-dbe1-4811-baf5-798f5f874639
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d752e82-6b47-4d98-a566-05631454a27f
Secureworks BRONZE FLEETWOOD ProfileATTACK:enterprise:C0052 → attributed-to → ATTACK:enterprise:G1023
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e632f9c-c55b-4aef-8bdc-56e0317375ee
ORB MandiantATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81ce1970-88fa-4820-8f08-9a2a8332df77
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8fdfcd23-4608-4a40-98fc-2e4baa8d6a41
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--945d45de-810c-42e9-b37c-ebfbc576dc01
Mandiant Pulse Secure Zero-Day April 2021 · Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95416174-bdf3-4ffc-9174-6b89d4b72cd4
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1098.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96d35fa9-9278-4582-80c9-9286ca57e9c9
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b5abfd2-7c22-48df-bda3-62648c6cac8c
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4d00569-50d8-4571-9ea8-3cafcfbfaacb
Mandiant Pulse Secure Zero-Day April 2021 · Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S1109
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8362ccc-cf32-4f36-a4a3-cfcf70dd4c54
Mandiant Pulse Secure Zero-Day April 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1053.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6f9bc1d-bc66-4627-a1fd-56276a957320
NSA APT5 Citrix Threat Hunting December 2022ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bdafc5be-8887-4a16-993c-3e248373902b
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bec31996-2778-4e16-af9a-6a73f148a074
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1341f02-e2be-4c70-8d14-28170bee2133
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c45d16b1-9e15-4047-a0c9-4cb31d38ac48
Mandiant Pulse Secure Zero-Day April 2021 · Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccd387c3-f818-468e-ac13-24b6aab2a061
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdf6b439-62d6-4052-91ee-a154f674c68f
Mandiant Pulse Secure Zero-Day April 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ddb0965b-83ac-4746-bfaa-a7356691ef43
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0032
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de0b8fd5-c974-41ab-965d-2bbd145e207f
Secureworks BRONZE FLEETWOOD ProfileATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e062ec0b-3be4-42c6-8dba-7a8a8270bbd9
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S1108
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6ff8ec4-51c4-47d2-83a8-777d8c2a7b8e
Mandiant Pulse Secure Zero-Day April 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--edda676e-bd01-4983-b491-bf6c5d9a84db
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eef3ac92-4c31-4401-84fe-b6e298610ed9
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f147e87d-1ed7-4ab3-a414-0537a9bfb887
Microsoft East Asia Threats September 2023 · NSA APT5 Citrix Threat Hunting December 2022 · Mandiant Pulse Secure Zero-Day April 2021 · Mandiant Pulse Secure Update May 2021