TA459
TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--62a64fd3-aaf7-4d09-a375-d6f8bb118481
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-01T16:36:58+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (5)
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows techn
Software & Tools (4)
NetTraveler is malware that has been used in multiple cyber espionage campaigns for basic surveillance of v
PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita
ZeroT is a Trojan used by TA459, often in conjunction with [PlugX]
gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.
Explore this actor's full graph with Ninja Signal