APT4
APT4 is a Chinese state-affiliated threat actor. The provided content maps APT4 to Microsoft’s Salmon Typhoon naming and states that Salmon Typhoon is also known as SODIUM and Maverick Panda. The actor is described as a sophisticated Chinese espionage group and is associated with malware such as Win32/Wkysol. Microsoft and OpenAI reporting cited in the content states that Salmon Typhoon used LLM services in 2023 for exploratory reconnaissance on sensitive topics, including geopolitics, high-profile individuals, intelligence agencies, regional threat actors, and cybersecurity topics; for translating technical papers; for retrieving publicly available information on multiple intelligence agencies and regional threat actors; for coding assistance and coding error resolution; and for researching common ways processes could be hidden on a system. The content also states the model declined requests for support in developing potentially malicious code, and that associated accounts and assets were disabled. Separately, the content notes APT4 has been observed using XMRig. Known aliases in the provided content are APT4, Salmon Typhoon, SODIUM, and Maverick Panda.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Associated malware families
2 malware families attributed to this actor across reporting.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as another threat actor observed using XMRig.
China-linked nation-state threat actor listed in Microsoft's naming taxonomy mapping.
Referenced as a resurgent Chinese espionage group (no specific Pulse Secure tradecraft attributed in this text beyond general resurgence).
Listed as a China-linked named cluster; no additional operational detail provided in the content beyond inclusion in an APT group list.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.