LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0073: APT19

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. [1] Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same. [2] [3] [4]

EnterpriseG0073GroupObject v1.6Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G0073: APT19 describes [APT19](https://attack.mitre.org/groups/G0073) is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track [APT19](https://attack.mitre.org/groups/G0073) and [Deep Panda](https://attack.mitre.org/groups/G0009) as the same group, but it is unclear fro...

Executive priority

G0073: APT19 is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0073: APT19 by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G0073: APT19 appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

APT19

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. [1] Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same. [2] [3] [4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.[4]

EnterpriseT1059.001PowerShellSub-technique

APT19 used PowerShell commands to execute payloads.[1]

EnterpriseT1564.003Hidden WindowSub-technique

APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. [1]

EnterpriseT1016System Network Configuration Discovery

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.[4]

EnterpriseT1033System Owner/User Discovery

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.[4]

EnterpriseT1218.011Rundll32Sub-technique

APT19 configured its payload to inject into the rundll32.exe.[1]

EnterpriseT1112Modify Registry

APT19 uses a Port 22 malware variant to modify several Registry keys.[4]

EnterpriseT1189Drive-by Compromise

APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.[4]

EnterpriseT1543.003Windows ServiceSub-technique

An APT19 Port 22 malware variant registers itself as a service.[4]

EnterpriseT1071.001Web ProtocolsSub-technique

APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4]

EnterpriseT1059Command and Scripting Interpreter

APT19 downloaded and launched code within a SCT file.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

APT19 used Base64 to obfuscate payloads.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.[1]

EnterpriseT1204.002Malicious FileSub-technique

APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.[1]

EnterpriseT1082System Information Discovery

APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.[1][4]

EnterpriseT1132.001Standard EncodingSub-technique

An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.[4]

EnterpriseT1588.002ToolSub-technique

APT19 has obtained and used publicly-available tools like Empire.CitationNCSC Joint Report Public Tools[1]

EnterpriseT1574.001DLLSub-technique

APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.[4]

EnterpriseT1218.010Regsvr32Sub-technique

APT19 used Regsvr32 to bypass application control techniques.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.[4]

EnterpriseT1027.010Command ObfuscationSub-technique

APT19 used Base64 to obfuscate executed commands.[1]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S0154: Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]

LinuxmacOSWindows
ToolEnterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1059: Command and Scripting InterpreterEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · MalwareS0154: Cobalt StrikeEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · ToolS0363: EmpireEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
1.6
Created
Modified
Raw hash
ac43694c26c26cb8...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.01.6Current bundleac43694c26c2…
19.21.6Older bundleac43694c26c2…
19.11.6Older bundle9043f41e86b5…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye APT19

    Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.

    Open source URL
  2. [2]
    ICIT China's Espionage Jul 2016

    Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018.

    Open source URL
  3. [3]
    FireEye APT Groups

    FireEye. (n.d.). Advanced Persistent Threat Groups. Retrieved August 3, 2018.

    Open source URL
  4. [4]
    Unit 42 C0d0so0 Jan 2016

    Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.

    Open source URL
  5. [5]
    APT19

    (Citation: FireEye APT19)

  6. [6]
    C0d0so0

    (Citation: Unit 42 C0d0so0 Jan 2016)

  7. [7]
    Codoso

    (Citation: Unit 42 C0d0so0 Jan 2016)

  8. [8]
    Codoso Team

    (Citation: FireEye APT Groups)

  9. [9]
    Dark Reading Codoso Feb 2015

    Chickowski, E. (2015, February 10). Chinese Hacking Group Codoso Team Uses Forbes.com As Watering Hole. Retrieved September 13, 2018.

    Open source URL
  10. [10]
    Sunshop Group

    (Citation: Dark Reading Codoso Feb 2015)

  11. [11]
    mitre-attackG0073
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use