By Zach Hilbert — Jun 26, 2024

APT18

Who is APT18?

APT18 is a sophisticated threat group that has been attributed to China and active since 2009. This group is quick to make use of newly discovered vulnerabilities and exploits in order to compromise victims. FireEye compares APT18 to the activity of APT3. [2] While they share usage of exploits for vulnerabilities like CVE-2015-5119, APT18 has their own methods of generating phishing emails, creating exploits, and uses different C2 infrastructure. FireEye states that the phishing emails APT18 sends are generic in nature. The C2 infrastructure the attackers use typically includes "procured infrastructure" as opposed to using systems they previously compromised themselves.

Aliases

TG-0416
Dynamite Panda
Wekby

Associated Individuals

APT18 is attributed to Chinese attackers

Notable Attacks

Specific victims have not been revealed, but a large range of industries are listed by multiple researchers as victims.

Tactics

Malware Used

HTTPBrowser
hcdLoader
PisLoader
gh0st RAT

APT18 uses phishing emails to deliver malware and compromise victims. Once they are able to gain access, this group uses advanced techniques for C2 communication such as DNS TXT record requests containing the base32-encoded payload to be transferred. For example, the encoded data is added as a subdomain to the FQDN requested in the TXT record. [6] (See image below for an example). These attackers use common malware families such as HTTPBrowser, gh0st RAT, and hcdLoader as well as Windows tools like at.exe and PsExec for persistence, information retrieval, and lateral movement. APT18 uses new vulnerabilities quickly after initial disclosure. The combination of these tactics demonstrate the group's expertise and advanced technical capabilities.