admin@338
[admin@338](https://attack.mitre.org/groups/G0018) is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as [PoisonIvy](https://attack.mitre.org/software/S0012), as well as some non-public backdoors. (Citation: FireEye admin@338)
Properties
- stix_id
- intrusion-set--16ade1aa-0ea1-4bb7-88cc-9079df2ae756
- signal_observed_at
- 2026-09-11T17:54:59+00:00
- type
- intrusion-set
MITRE ATT&CK Techniques (12)
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s
Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a sys
Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries dete
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through info
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as wel
Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the prima
Software & Tools (7)
[BUBBLEWRAP](https://attack.mitre.org/software/S0043) is a full-featured, second-stage backdoor used by the [admin@338](https://attack.mitre.org/group
[LOWBALL](https://attack.mitre.org/software/S0042) is malware used by [admin@338](https://attack.mitre.org/groups/G0018). It was used in August 2015 i
The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for c
[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison
[Systeminfo](https://attack.mitre.org/software/S0096) is a Windows utility that can be used to gather detailed information about a computer. (Citation
[ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and
[netstat](https://attack.mitre.org/software/S0104) is an operating system utility that displays active TCP connections, listening ports, and network s
Explore this actor's full graph with Ninja Signal