Threat Actor
APT17
Also known as: APT17, Deputy Dog
APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations.
2
Techniques
1
Software
0
indicators on this record
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--090242d7-73fc-4738-af68-20162f7a5aae
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T12:53:29+00:00
- Origin source
- attack_description
- Type
- intrusion-set
- Origin country
- CN
MITRE ATT&CK Techniques (2)
▸
Establish Accounts (T1585)
Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to bui
▸
Web Services (T1583.006)
Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web
Software & Tools (1)
▸
BLACKCOFFEE [malware]
BLACKCOFFEE is malware that has been used by several Chinese groups since at least 2013. (Citation: FireEye
Explore this actor's full graph with Ninja Signal