LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0073: APT19

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. [1] Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same. [2] [3] [4]

EnterpriseG0073GroupObject v1.6Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

APT19 is an ATT&CK group entry for a Chinese-based threat group reported to have targeted multiple industries, including defense, finance, energy, pharmaceuticals, telecommunications, high tech, education, manufacturing, and legal services. For leaders, the practical value is not to assume current exposure, but to use the mapped behaviors as a readiness checklist for targeted intrusion scenarios: phishing or drive-by entry, scripted execution, post-exploitation tooling, discovery, persistence, and command-and-control over web protocols.

Executive priority

Prioritize this object where the organization operates in one of the referenced sectors or has high-value legal, investment, intellectual property, regulated, or operational data. The ATT&CK relationships point to controls that often determine resilience against targeted intrusions: email and web initial-access defenses, endpoint visibility for PowerShell and signed Windows utilities, persistence monitoring, and C2 detection over common web traffic. Executives should ask whether SOC and IR teams can prove collection and response coverage for these behaviors rather than relying on group-name blocking or attribution-based assumptions.

Technical view

ATT&CK does not provide a detection section for APT19, so defenders should validate coverage against the related techniques and software instead. Relationship-driven priorities include spearphishing attachments, malicious file execution, drive-by compromise, command and scripting interpreter activity including PowerShell, use of post-exploitation frameworks such as Cobalt Strike and Empire, discovery commands for system/user/network information, registry and service persistence, Run keys/startup folders, DLL abuse, Regsvr32/Rundll32 proxy execution, obfuscation/encoding/deobfuscation, and web-protocol C2. Because the group object has no specified platforms, platform scope should be derived from local assets and the related technique/software platform fields, especially Windows endpoints for PowerShell, registry, services, Regsvr32, Rundll32, and DLL-related behaviors.

Likely telemetry

  • Email security logs and message metadata for spearphishing attachment investigations
  • Web proxy, DNS, and network security logs for drive-by and web-protocol command-and-control patterns
  • Endpoint process creation and command-line telemetry, especially PowerShell and other interpreters
  • PowerShell script block/module logging where deployed
  • Windows Registry change telemetry for Run keys and other persistence-related modifications

Detection direction

  • Do not build coverage around the APT19 name alone; map detections to the related ATT&CK techniques and software relationships.
  • Validate alerting for suspicious interpreter usage, encoded or obfuscated command lines, and PowerShell activity that is unusual for the user, host role, or parent process.
  • Tune detections for Regsvr32 and Rundll32 to reduce false positives by baselining legitimate administrative and application activity, then alerting on unusual paths, network access, scriptlet-like behavior, or suspicious parent-child process chains where telemetry supports it.
  • Correlate initial-access signals such as phishing attachments or suspicious browsing with follow-on execution, discovery, persistence, and outbound web traffic rather than treating each event in isolation.
  • Review blind spots in encrypted web traffic inspection, endpoint command-line capture, PowerShell logging, registry auditing, and service-change monitoring.

Mitigation priorities

  • Start with initial-access risk reduction: strengthen email attachment controls, user reporting workflows, and web browsing protections for targeted phishing and drive-by scenarios.
  • Harden script and interpreter use with least privilege, constrained administrative access, and policy controls appropriate to the environment.
  • Improve endpoint hardening and monitoring for Windows persistence paths, including Registry Run keys, startup folders, and service creation or modification.
  • Review allowlisting and application control assumptions for signed Windows utilities such as Regsvr32 and Rundll32, since trusted binaries can be abused.
  • Ensure incident response playbooks cover post-exploitation frameworks and include containment steps for hosts showing discovery, persistence, and web-based C2 indicators.
Additional notes and limits

The official group description cites broad industry targeting and a 2017 phishing campaign against seven law and investment firms. It also notes that some analysts track APT19 and Deep Panda as the same group, but that open-source information is unclear. The related techniques provide more operational value than the sparse group-level fields: they describe a pattern of initial access, execution, stealth, discovery, persistence, and command-and-control behaviors that can be validated defensively without making attribution claims.

MITRE provides no official detection text, no group-level platforms, and no tactics directly on the APT19 object. The recommendations above are derived from supplied ATT&CK relationships and external references only. Local relevance depends on the organization’s sector, exposed users, endpoint and cloud footprint, logging maturity, and whether the listed techniques/software behaviors are observable in the environment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

APT19

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. [1] Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same. [2] [3] [4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.[4]

EnterpriseT1059.001PowerShellSub-technique

APT19 used PowerShell commands to execute payloads.[1]

EnterpriseT1564.003Hidden WindowSub-technique

APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. [1]

EnterpriseT1016System Network Configuration Discovery

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.[4]

EnterpriseT1033System Owner/User Discovery

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.[4]

EnterpriseT1218.011Rundll32Sub-technique

APT19 configured its payload to inject into the rundll32.exe.[1]

EnterpriseT1112Modify Registry

APT19 uses a Port 22 malware variant to modify several Registry keys.[4]

EnterpriseT1189Drive-by Compromise

APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.[4]

EnterpriseT1543.003Windows ServiceSub-technique

An APT19 Port 22 malware variant registers itself as a service.[4]

EnterpriseT1071.001Web ProtocolsSub-technique

APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4]

EnterpriseT1059Command and Scripting Interpreter

APT19 downloaded and launched code within a SCT file.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

APT19 used Base64 to obfuscate payloads.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.[1]

EnterpriseT1204.002Malicious FileSub-technique

APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.[1]

EnterpriseT1082System Information Discovery

APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.[1][4]

EnterpriseT1132.001Standard EncodingSub-technique

An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.[4]

EnterpriseT1588.002ToolSub-technique

APT19 has obtained and used publicly-available tools like Empire.[5][1]

EnterpriseT1574.001DLLSub-technique

APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.[4]

EnterpriseT1218.010Regsvr32Sub-technique

APT19 used Regsvr32 to bypass application control techniques.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.[4]

EnterpriseT1027.010Command ObfuscationSub-technique

APT19 used Base64 to obfuscate executed commands.[1]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S0154: Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]

LinuxmacOSWindows
ToolEnterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1059: Command and Scripting InterpreterEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · MalwareS0154: Cobalt StrikeEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · ToolS0363: EmpireEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.6
Created
Modified
Raw hash
9043f41e86b5abf3...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.6Current bundle9043f41e86b5…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  2. [2]
    ICIT China's Espionage Jul 2016

    Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018.

    Open source URL
  3. [3]
    FireEye APT Groups

    FireEye. (n.d.). Advanced Persistent Threat Groups. Retrieved August 3, 2018.

    Open source URL
  4. [4]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  5. [5]
    NCSC Joint Report Public Tools

    The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

    Open source URL
  6. [6]
    APT19

    (Citation: FireEye APT19)

  7. [7]
    APT19

    (Citation: FireEye APT19)

  8. [8]
    APT19

    (Citation: FireEye APT19)

  9. [9]
    C0d0so0

    (Citation: Unit 42 C0d0so0 Jan 2016)

  10. [10]
    C0d0so0

    (Citation: Unit 42 C0d0so0 Jan 2016)

  11. [11]
    C0d0so0

    (Citation: Unit 42 C0d0so0 Jan 2016)

  12. [12]
    Codoso

    (Citation: Unit 42 C0d0so0 Jan 2016)

  13. [13]
    Codoso

    (Citation: Unit 42 C0d0so0 Jan 2016)

  14. [14]
    Codoso

    (Citation: Unit 42 C0d0so0 Jan 2016)

  15. [15]
    Codoso Team

    (Citation: FireEye APT Groups)

  16. [16]
    Codoso Team

    (Citation: FireEye APT Groups)

  17. [17]
    Codoso Team

    (Citation: FireEye APT Groups)

  18. [18]
    Dark Reading Codoso Feb 2015

    Chickowski, E. (2015, February 10). Chinese Hacking Group Codoso Team Uses Forbes.com As Watering Hole. Retrieved September 13, 2018.

    Open source URL
  19. [19]
    Dark Reading Codoso Feb 2015

    Chickowski, E. (2015, February 10). Chinese Hacking Group Codoso Team Uses Forbes.com As Watering Hole. Retrieved September 13, 2018.

    Open source URL
  20. [20]
    Dark Reading Codoso Feb 2015

    Chickowski, E. (2015, February 10). Chinese Hacking Group Codoso Team Uses Forbes.com As Watering Hole. Retrieved September 13, 2018.

    Open source URL
  21. [21]
    FireEye APT Groups

    FireEye. (n.d.). Advanced Persistent Threat Groups. Retrieved August 3, 2018.

    Open source URL
  22. [22]
    FireEye APT Groups

    FireEye. (n.d.). Advanced Persistent Threat Groups. Retrieved August 3, 2018.

    Open source URL
  23. [23]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  24. [24]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  25. [25]
    ICIT China's Espionage Jul 2016

    Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018.

    Open source URL
  26. [26]
    ICIT China's Espionage Jul 2016

    Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018.

    Open source URL
  27. [27]
    Sunshop Group

    (Citation: Dark Reading Codoso Feb 2015)

  28. [28]
    Sunshop Group

    (Citation: Dark Reading Codoso Feb 2015)

  29. [29]
    Sunshop Group

    (Citation: Dark Reading Codoso Feb 2015)

  30. [30]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  31. [31]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  32. [32]
    mitre-attackG0073
    Open source URL
  33. [33]
    mitre-attackG0073
    Open source URL
  34. [34]
    mitre-attackG0073
    Open source URL
  35. [35]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  36. [36]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  37. [37]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  38. [38]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  39. [39]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  40. [40]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  41. [41]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  42. [42]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  43. [43]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  44. [44]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  45. [45]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  46. [46]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  47. [47]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  48. [48]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  49. [49]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  50. [50]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  51. [51]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  52. [52]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  53. [53]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  54. [54]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  55. [55]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  56. [56]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  57. [57]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  58. [58]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  59. [59]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  60. [60]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  61. [61]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  62. [62]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  63. [63]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  64. [64]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  65. [65]
    NCSC Joint Report Public Tools

    The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

    Open source URL
  66. [66]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  67. [67]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  68. [68]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  69. [69]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  70. [70]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  71. [71]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  72. [72]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  73. [73]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  74. [74]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  75. [75]
    NCSC Joint Report Public Tools

    The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

    Open source URL
  76. [76]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  77. [77]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  78. [78]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  79. [79]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use