LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G1023: APT5

APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.[1][2][3][4][5][6]

EnterpriseG1023GroupObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

APT5 matters because ATT&CK describes it as a long-running China-based espionage group focused on telecommunications, aerospace, and defense, with particular interest in networking devices, underlying software, and zero-day exploitation. For leaders, the practical issue is not just malware names: it is whether internet-facing access infrastructure, VPNs, domain credentials, and remote administration paths are observable and recoverable during an espionage-driven intrusion.

Executive priority

Prioritize APT5-informed readiness where business depends on sensitive engineering, defense, telecom, or externally reachable access infrastructure. Executives should ask whether the organization can prove timely vulnerability management for network devices, detect credential theft and remote access abuse, and preserve logs from VPN/network appliances for incident response and audit evidence. The relationship to SPACEHOP Activity also makes leased VPS/ORB-style infrastructure a relevant threat-intelligence and perimeter-monitoring concern, without assuming any specific local exposure.

Technical view

ATT&CK provides no official detection text for APT5, so validation should be built from the related techniques, software, and campaign context. Key defensive checks include coverage for credential access on Windows such as LSASS Memory and SAM extraction, domain-controller risks associated with Skeleton Key-style behavior, RAT activity such as PoisonIvy, gh0st RAT, and PcShare, and abuse of legitimate utilities including Net, Tasklist, and netstat. Network-device and VPN-focused hunting is especially important because related APT5 software includes SLOWPULSE, PULSECHECK, PACEMAKER, SLIGHTPULSE, and RAPIDPULSE, several of which are described around Pulse Secure VPNs, credential logging/stealing, authentication bypass flows, and web shells.

Likely telemetry

  • VPN and network-device authentication logs, administrative access logs, configuration change records, and file integrity evidence where available
  • Web shell indicators on network devices or Linux-based appliances, including unexpected script files or modified legitimate files
  • Windows endpoint and server telemetry for LSASS access, SAM access, process injection, suspicious credential dumping tools, and unusual child processes
  • Domain controller security logs and authentication events relevant to credential abuse or backdoor credential behavior
  • RDP and SSH logon records, including source IPs, account context, session timing, and lateral movement patterns

Detection direction

  • Do not rely on a single APT5 signature; map coverage to the related ATT&CK techniques and software actually present in the environment.
  • Validate whether security monitoring includes network devices and VPN appliances, since these are common blind spots compared with managed Windows endpoints.
  • Tune credential-access detections for high-risk systems, especially domain controllers, VPN infrastructure, administrative workstations, and servers that can expose reusable credentials.
  • Correlate discovery commands, process enumeration, network connection discovery, and remote access logons with account privilege, asset criticality, and source network context to reduce false positives from legitimate administration.
  • Use the SPACEHOP Activity relationship to enrich perimeter analytics with suspicious VPS/relay infrastructure patterns, while treating infrastructure reputation as supporting context rather than standalone proof.

Mitigation priorities

  • Start with inventory and vulnerability management for internet-facing networking devices, VPNs, and remote access services, including evidence that patches and mitigations are applied and verified.
  • Harden identity paths by limiting administrative credential exposure, reducing unnecessary privileged sessions, protecting credential material, and monitoring high-value accounts.
  • Restrict and monitor RDP and SSH access, especially between internal segments and to critical systems, using least privilege and strong authentication where applicable.
  • Improve resilience of domain controllers and VPN infrastructure through logging, configuration baselines, file integrity checks where feasible, and tested recovery procedures.
  • Prepare IR playbooks for suspected network-device compromise and credential theft, including credential rotation, appliance forensic collection, and validation of persistence mechanisms such as web shells or scheduled tasks.
Additional notes and limits

This take is based on ATT&CK G1023 version 1.1 in enterprise-attack, its official description, external references, and supplied relationships. The group object itself lists no platforms or tactics and provides no official detection guidance, so platform-specific comments are derived only from related software and technique relationships. Local asset exposure, logging maturity, and control effectiveness must be validated before drawing conclusions about risk or coverage.

ATT&CK relationships provide behavior context but do not prove that every listed technique or tool will appear in every APT5 intrusion. The supplied SPACEHOP campaign description is truncated, and no customer-specific telemetry, exploit details, or active exploitation status is provided. This assessment should therefore guide defensive validation rather than serve as evidence of compromise.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

APT5

APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.[1][2][3][4][5][6]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

29 rows
DomainIDNameRelationship / procedure
EnterpriseT1059.001PowerShellSub-technique

APT5 has used PowerShell to accomplish tasks within targeted environments.[4]

EnterpriseT1136.001Local AccountSub-technique

APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.[4]

EnterpriseT1070.006TimestompSub-technique

APT5 has modified file timestamps.[4]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

APT5 has moved laterally throughout victim environments using RDP.[4]

EnterpriseT1654Log Enumeration

APT5 has used the BLOODMINE utility to parse and extract information from Pulse Secure Connect logs.[4]

EnterpriseT1685Disable or Modify Tools

APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.[4]

EnterpriseT1583.005BotnetSub-technique

APT5 has acquired a network of compromised systems – specifically an ORB (operational relay box) network – for follow on activities.[7]

EnterpriseT1074.001Local Data StagingSub-technique

APT5 has staged data on compromised systems prior to exfiltration often in `C:\Users\Public`.[4]

EnterpriseT1554Compromise Host Software Binary

APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.[3][4]

EnterpriseT1056.001KeyloggingSub-technique

APT5 has used malware with keylogging capabilities to monitor the communications of targeted entities.[5][6]

EnterpriseT1078.004Cloud AccountsSub-technique

APT5 has accessed Microsoft M365 cloud environments using stolen credentials. [4]

EnterpriseT1560.001Archive via UtilitySub-technique

APT5 has used the JAR/ZIP file format for exfiltrated files.[4]

EnterpriseT1003.001LSASS MemorySub-technique

APT5 has used the Task Manager process to target LSASS process memory in order to obtain NTLM password hashes. APT5 has also dumped clear text passwords and hashes from memory using Mimikatz hosted through an RDP mapped drive.[4]

EnterpriseT1003.002Security Account ManagerSub-technique

APT5 has copied and exfiltrated the SAM Registry hive from targeted systems.[4]

EnterpriseT1070.004File DeletionSub-technique

APT5 has deleted scripts and web shells to evade detection.[3][4]

EnterpriseT1098.007Additional Local or Domain GroupsSub-technique

APT5 has created their own accounts with Local Administrator privileges to maintain access to systems with short-cycle credential rotation.[4]

EnterpriseT1057Process Discovery

APT5 has used Windows-based utilities to carry out tasks including tasklist.exe. [4]

EnterpriseT1070Indicator Removal

APT5 has used the THINBLOOD utility to clear SSL VPN log files located at `/home/runtime/logs`.[3][4]

EnterpriseT1053.003CronSub-technique

APT5 has made modifications to the crontab file including in `/var/cron/tabs/`.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

APT5 has used cmd.exe for execution on compromised systems.[4]

EnterpriseT1021.004SSHSub-technique

APT5 has used SSH for lateral movement in compromised environments including for enabling access to ESXi host servers.[4]

EnterpriseT1055Process Injection

APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to alter its functionality.[4]

EnterpriseT1505.003Web ShellSub-technique

APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.[3][4]

EnterpriseT1049System Network Connections Discovery

APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.[4]

EnterpriseT1078.002Domain AccountsSub-technique

APT5 has used legitimate account credentials to move laterally through compromised environments.[3]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

APT5 has named exfiltration archives to mimic Windows Updates at times using filenames with a `KB.zip` pattern.[4]

EnterpriseT1070.003Clear Command HistorySub-technique

APT5 has cleared the command history on targeted ESXi servers.[4]

EnterpriseT1083File and Directory Discovery

APT5 has used the BLOODMINE utility to discover files with .css, .jpg, .png, .gif, .ico, .js, and .jsp extensions in Pulse Secure Connect logs.[4]

EnterpriseT1190Exploit Public-Facing Application

APT5 has exploited vulnerabilities in externally facing software and devices including Pulse Secure VPNs and Citrix Application Delivery Controllers.[3][4][1] [2]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0057: Tasklist

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. [1]

ToolEnterprise

S1050: PcShare

PcShare is an open source remote access tool that has been modified and used by Chinese threat actors, most notably during the FunnyDream campaign since late 2018.[1][2]

Windows
ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
MalwareEnterprise

S1104: SLOWPULSE

SLOWPULSE is a malware that was used by APT5 as early as 2020 including against U.S. Defense Industrial Base (DIB) companies. SLOWPULSE has several variants and can modify legitimate Pulse Secure VPN files in order to log credentials and bypass single and two-factor authentication flows.[1]

Network Devices
MalwareEnterprise

S1110: SLIGHTPULSE

SLIGHTPULSE is a web shell that was used by APT5 as early as 2020 including against Pulse Secure VPNs at US Defense Industrial Base (DIB) entities.[1]

Network DevicesLinux
ToolEnterprise

S0039: Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Windows
MalwareEnterprise

S1109: PACEMAKER

PACEMAKER is a credential stealer that was used by APT5 as early as 2020 including activity against US Defense Industrial Base (DIB) companies.[1]

Network DevicesLinux
MalwareEnterprise

S1108: PULSECHECK

PULSECHECK is a web shell written in Perl that was used by APT5 as early as 2020 including against Pulse Secure VPNs at US Defense Industrial Base (DIB) companies.[1]

Network DevicesLinux
CampaignEnterprise

C0052: SPACEHOP Activity

SPACEHOP Activity is conducted through commercially leased Virtual Private Servers (VPS), otherwise known as provisioned Operational Relay Box (ORB) networks. The network leveraged for SPACEHOP Activity enabled China-nexus cyber threat actors – such as APT5 and Ke3chang – to perform network reconnaissance scanning and vulnerability exploitation. SPACEHOP Activity has historically targeted entities in North America, Europe, and the Middle East.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1136.001: Local AccountEnterpriseuses · ToolS0057: TasklistEnterpriseuses · TechniqueT1070.006: TimestompEnterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · MalwareS0012: PoisonIvyEnterpriseuses · TechniqueT1654: Log EnumerationEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · MalwareS1113: RAPIDPULSEEnterpriseuses · TechniqueT1583.005: BotnetEnterpriseuses · ToolS1050: PcShareEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · ToolS0002: MimikatzEnterpriseuses · TechniqueT1554: Compromise Host Software BinaryEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1078.004: Cloud AccountsEnterpriseuses · MalwareS1104: SLOWPULSEEnterpriseuses · MalwareS1110: SLIGHTPULSEEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · MalwareS0007: Skeleton KeyEnterpriseattributed to · CampaignC0052: SPACEHOP ActivityEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · TechniqueT1003.002: Security Account ManagerEnterpriseuses · TechniqueT1070.004: File DeletionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
b7a2b39aeb7d74c2...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundleb7a2b39aeb7d…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    NSA APT5 Citrix Threat Hunting December 2022

    National Security Agency. (2022, December). APT5: Citrix ADC Threat Hunting Guidance. Retrieved February 5, 2024.

    Open source URL
  2. [2]
    Microsoft East Asia Threats September 2023

    Microsoft Threat Intelligence. (2023, September). Digital threats from East Asia increase in breadth and effectiveness. Retrieved February 5, 2024.

    Open source URL
  3. [3]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  4. [4]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  5. [5]
    FireEye Southeast Asia Threat Landscape March 2015

    FireEye. (2015, March). SOUTHEAST ASIA: AN EVOLVING CYBER THREAT LANDSCAPE. Retrieved February 5, 2024.

    Open source URL
  6. [6]
    Mandiant Advanced Persistent Threats

    Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.

    Open source URL
  7. [7]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  8. [8]
    Secureworks BRONZE FLEETWOOD Profile

    Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.

    Open source URL
  9. [9]
    BRONZE FLEETWOOD

    (Citation: Secureworks BRONZE FLEETWOOD Profile)

  10. [10]
    BRONZE FLEETWOOD

    (Citation: Secureworks BRONZE FLEETWOOD Profile)

  11. [11]
    BRONZE FLEETWOOD

    (Citation: Secureworks BRONZE FLEETWOOD Profile)

  12. [12]
    FireEye Southeast Asia Threat Landscape March 2015

    FireEye. (2015, March). SOUTHEAST ASIA: AN EVOLVING CYBER THREAT LANDSCAPE. Retrieved February 5, 2024.

    Open source URL
  13. [13]
    FireEye Southeast Asia Threat Landscape March 2015

    FireEye. (2015, March). SOUTHEAST ASIA: AN EVOLVING CYBER THREAT LANDSCAPE. Retrieved February 5, 2024.

    Open source URL
  14. [14]
    Keyhole Panda

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Secureworks BRONZE FLEETWOOD Profile)

  15. [15]
    Keyhole Panda

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Secureworks BRONZE FLEETWOOD Profile)

  16. [16]
    Keyhole Panda

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Secureworks BRONZE FLEETWOOD Profile)

  17. [17]
    MANGANESE

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: NSA APT5 Citrix Threat Hunting December 2022)

  18. [18]
    MANGANESE

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: NSA APT5 Citrix Threat Hunting December 2022)

  19. [19]
    MANGANESE

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: NSA APT5 Citrix Threat Hunting December 2022)

  20. [20]
    Mandiant Advanced Persistent Threats

    Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.

    Open source URL
  21. [21]
    Mandiant Advanced Persistent Threats

    Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.

    Open source URL
  22. [22]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  23. [23]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  24. [24]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  25. [25]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  26. [26]
    Microsoft East Asia Threats September 2023

    Microsoft Threat Intelligence. (2023, September). Digital threats from East Asia increase in breadth and effectiveness. Retrieved February 5, 2024.

    Open source URL
  27. [27]
    Microsoft East Asia Threats September 2023

    Microsoft Threat Intelligence. (2023, September). Digital threats from East Asia increase in breadth and effectiveness. Retrieved February 5, 2024.

    Open source URL
  28. [28]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  29. [29]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  30. [30]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  31. [31]
    Mulberry Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Microsoft East Asia Threats September 2023)

  32. [32]
    Mulberry Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Microsoft East Asia Threats September 2023)

  33. [33]
    Mulberry Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Microsoft East Asia Threats September 2023)

  34. [34]
    NSA APT5 Citrix Threat Hunting December 2022

    National Security Agency. (2022, December). APT5: Citrix ADC Threat Hunting Guidance. Retrieved February 5, 2024.

    Open source URL
  35. [35]
    NSA APT5 Citrix Threat Hunting December 2022

    National Security Agency. (2022, December). APT5: Citrix ADC Threat Hunting Guidance. Retrieved February 5, 2024.

    Open source URL
  36. [36]
    Secureworks BRONZE FLEETWOOD Profile

    Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.

    Open source URL
  37. [37]
    Secureworks BRONZE FLEETWOOD Profile

    Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.

    Open source URL
  38. [38]
    UNC2630

    (Citation: NSA APT5 Citrix Threat Hunting December 2022)

  39. [39]
    UNC2630

    (Citation: NSA APT5 Citrix Threat Hunting December 2022)

  40. [40]
    UNC2630

    (Citation: NSA APT5 Citrix Threat Hunting December 2022)

  41. [41]
    mitre-attackG1023
    Open source URL
  42. [42]
    mitre-attackG1023
    Open source URL
  43. [43]
    mitre-attackG1023
    Open source URL
  44. [44]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  45. [45]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  46. [46]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  47. [47]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  48. [48]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  49. [49]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  50. [50]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  51. [51]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  52. [52]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  53. [53]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  54. [54]
    Mandiant Advanced Persistent Threats

    Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.

    Open source URL
  55. [55]
    Mandiant Advanced Persistent Threats

    Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.

    Open source URL
  56. [56]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  57. [57]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  58. [58]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  59. [59]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  60. [60]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  61. [61]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  62. [62]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  63. [63]
    Secureworks BRONZE FLEETWOOD Profile

    Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.

    Open source URL
  64. [64]
    Secureworks BRONZE FLEETWOOD Profile

    Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.

    Open source URL
  65. [65]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  66. [66]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  67. [67]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  68. [68]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  69. [69]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  70. [70]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  71. [71]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  72. [72]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  73. [73]
    FireEye Southeast Asia Threat Landscape March 2015

    FireEye. (2015, March). SOUTHEAST ASIA: AN EVOLVING CYBER THREAT LANDSCAPE. Retrieved February 5, 2024.

    Open source URL
  74. [74]
    FireEye Southeast Asia Threat Landscape March 2015

    FireEye. (2015, March). SOUTHEAST ASIA: AN EVOLVING CYBER THREAT LANDSCAPE. Retrieved February 5, 2024.

    Open source URL
  75. [75]
    Mandiant Advanced Persistent Threats

    Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.

    Open source URL
  76. [76]
    Mandiant Advanced Persistent Threats

    Mandiant. (n.d.). Advanced Persistent Threats (APTs). Retrieved February 14, 2024.

    Open source URL
  77. [77]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  78. [78]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  79. [79]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  80. [80]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  81. [81]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  82. [82]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  83. [83]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  84. [84]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  85. [85]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  86. [86]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  87. [87]
    Secureworks BRONZE FLEETWOOD Profile

    Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.

    Open source URL
  88. [88]
    Secureworks BRONZE FLEETWOOD Profile

    Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.

    Open source URL
  89. [89]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  90. [90]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  91. [91]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  92. [92]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  93. [93]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  94. [94]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  95. [95]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  96. [96]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  97. [97]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  98. [98]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  99. [99]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  100. [100]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  101. [101]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  102. [102]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  103. [103]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  104. [104]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  105. [105]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  106. [106]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  107. [107]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  108. [108]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  109. [109]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  110. [110]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  111. [111]
    NSA APT5 Citrix Threat Hunting December 2022

    National Security Agency. (2022, December). APT5: Citrix ADC Threat Hunting Guidance. Retrieved February 5, 2024.

    Open source URL
  112. [112]
    NSA APT5 Citrix Threat Hunting December 2022

    National Security Agency. (2022, December). APT5: Citrix ADC Threat Hunting Guidance. Retrieved February 5, 2024.

    Open source URL
  113. [113]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  114. [114]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  115. [115]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  116. [116]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  117. [117]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  118. [118]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  119. [119]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  120. [120]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  121. [121]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  122. [122]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  123. [123]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  124. [124]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  125. [125]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  126. [126]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  127. [127]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  128. [128]
    Secureworks BRONZE FLEETWOOD Profile

    Secureworks CTU. (n.d.). BRONZE FLEETWOOD. Retrieved February 5, 2024.

    Open source URL
  129. [129]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  130. [130]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  131. [131]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  132. [132]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  133. [133]
    Mandiant Pulse Secure Update May 2021

    Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.

    Open source URL
  134. [134]
    Mandiant Pulse Secure Zero-Day April 2021

    Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.

    Open source URL
  135. [135]
    Microsoft East Asia Threats September 2023

    Microsoft Threat Intelligence. (2023, September). Digital threats from East Asia increase in breadth and effectiveness. Retrieved February 5, 2024.

    Open source URL
  136. [136]
    NSA APT5 Citrix Threat Hunting December 2022

    National Security Agency. (2022, December). APT5: Citrix ADC Threat Hunting Guidance. Retrieved February 5, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use