APT12
APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--c47f937f-1022-4f42-8525-e7a4779a14cb
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-01T16:36:58+00:00
- Origin source
- attack_description
- Type
- intrusion-set
- Origin country
- CN
MITRE ATT&CK Techniques (5)
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove
Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rathe
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp
Software & Tools (3)
HTRAN is a tool that proxies connections through intermediate hops and aids users in disguising their true
Ixeshe is a malware family that has been used since at least 2009 against targets in East Asia. (Citation:
RIPTIDE is a proxy-aware backdoor used by APT12. (Citation: Moran
Explore this actor's full graph with Ninja Signal