CNChinaconfidence: 50G0026

APT18APT18

Also known as: DYNAMITE PANDA · TG-0416 · SCANDIUM · PLA Navy · Wekby · G0026 · Satin Typhoon · APT18

Origin
CN
Known aliases
8
Target sectors
3
Attribution
State-sponsored

Profile

Wekby was described by Palo Alto Networks in a 2015 report as: 'Wekby is a group that has been active for a number of years, targeting various industries such as healthcare, telecommunications, aerospace, defense, and high tech. The group is known to leverage recently released exploits very shortly after those exploits are available, such as in the case of HackingTeams Flash zero - day exploit.'

Aliases· 8

DYNAMITE PANDATG-0416SCANDIUMPLA NavyWekbySatin TyphoonAPT18
G0026

Target sectors· 3

GovernmentPrivate sectorCivil society

Known victims· 1

  • United States

MITRE ATT&CK Group crosswalk

G0026

References

  1. https://threatpost.com/apt-gang-branches-out-to-medical-espionage-in-community-health-breach/107828
  2. https://www.cfr.org/interactive/cyber-operations/apt-18
  3. https://attack.mitre.org/groups/G0026
  4. https://www.mandiant.com/resources/insights/apt-groups

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

Actor
APT19
Actor
APT17
Actor
APT15
Actor
UAT-5918
Actor
APT4
Actor
APT21
Sourced from MISP-Galaxy Threat Actor cluster. Curated by Adam Lundqvist, Founder at SQUR.