Loading threat actor…
Tonto Team is a Chinese state-sponsored cyberespionage actor active since at least 2009. It is also known as CactusPete, Bronze Huntley, Copper Typhoon, Earth Akhlut, Karma Panda, HeartBeat, Sharp R, TAG-74, and Team Tonto. Its targets include government, military, energy, financial, educational, healthcare, and technology organizations. Early operations focused on South Korea, Japan, Taiwan, and the United States, with activity expanding into Eastern Europe by 2020. Its targeting includes cybersecurity companies and software-development organizations. The group uses spearphishing attachments, organizational impersonation, and malicious RTF documents generated with the Royal Road exploit builder. Its malware includes Bisonal and Bisonal.DoubleT, Bisonal.Dropper, ShadowPad, and the QuickMute downloader, also known as TontoTeam.Downloader. These tools support host discovery, remote command execution, process management, payload delivery, and command-and-control communications. Observed deployments use registry-based persistence, encrypted or obfuscated payloads and communications, and in-memory loading of additional components. Tonto Team has exploited CVE-2019-0803 and the Windows vulnerability addressed by MS16-032 for privilege escalation, and EternalBlue for lateral movement. In March 2021, it exploited Microsoft Exchange ProxyLogon vulnerabilities to compromise email servers at Eastern European procurement and cybersecurity-consulting companies, deploying ShadowPad and Bisonal. It also conducted unsuccessful spearphishing attacks against Group-IB employees in 2021 and 2022. Tonto Team has shared infrastructure and tooling with Tick; use of shared tools such as ShadowPad and Royal Road is not independently sufficient for attribution.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
91 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
30 malware families Mallory has associated with this actor across public reporting.
25 additional families tracked in Mallory.
15 CVEs Mallory has associated with this actor across public reporting. 15 of them are exploited in the wild (not necessarily by this actor).
9 more CVEs tied to this actor tracked in Mallory.
433 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.