APT12

APT12, also known as Numbered Panda, is a China-attributed threat group. Aliases provided in the content include Calc Team, DNSCALC / DNS_Calc, DynCalc, Hexagon Typhoon, Horde, Hydrogen, IXESHE, Numbered Panda, and Red Anubis. The group has targeted media organizations, high-technology companies, and multiple governments. Mandiant internally referred to the group as APT12 in reporting on the intrusion into The New York Times, which it assessed as part of a broader Chinese cyber-espionage campaign against Western media, journalists, corporations, and other organizations. Directly referenced tradecraft includes spearphishing emails with malicious Microsoft Office documents and PDF attachments, attempting to induce victims to open malicious Word and PDF files, and exploitation of multiple client-side vulnerabilities for execution, including Microsoft Office CVE-2009-3129 and CVE-2012-0158, Adobe Reader CVE-2009-4324 and CVE-2009-0927, and Adobe Flash CVE-2011-0609 and CVE-2011-0611. The group has used the RIPTIDE RAT, which communicates over HTTP and uses RC4-encrypted payloads, and has used blogs and WordPress for command-and-control infrastructure. The content also notes APT12 use of HTRAN. In the New York Times intrusion described in the content, investigators found the attackers compromised employee passwords, accessed the personal computers of 53 employees, targeted the email accounts of David Barboza and Jim Yardley, established multiple backdoors, used compromised U.S. university systems as proxies, deployed custom malware, and created software to search for and collect targeted emails and documents. Mandiant stated the intrusion matched activity it tracked as APT12.