APT18 (G0026) | Threat Actor Index

About APT18

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical.

View MITRE record ↗

Techniques by Tactic (12)

Initial Access

T1078 Valid AccountsT1133 External Remote Services

Execution

T1053.002 AtT1059.003 Windows Command Shell

Persistence

T1053.002 AtT1078 Valid AccountsT1133 External Remote ServicesT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.002 AtT1078 Valid AccountsT1547.001 Registry Run Keys / Startup Folder

Stealth

T1027.013 Encrypted/Encoded FileT1070.004 File DeletionT1078 Valid Accounts

Discovery

T1082 System Information DiscoveryT1083 File and Directory Discovery

Command & Control

T1071.001 Web ProtocolsT1071.004 DNST1105 Ingress Tool Transfer

Toolsets (5)

🐛

HTTPBrowser S0070

Malware · Windows

🐛

Pisloader S0124

Malware · Windows

🐛

gh0st RAT S0032

Malware · Windows, macOS

🐛

hcdLoader S0071

Malware · Windows

🔧

cmd S0106

Tool · Windows

References & Reports (3)