Loading threat actor…
APT5 is a China-linked cyberespionage threat actor also known as Mulberry Typhoon, MANGANESE, Bronze Fleetwood, Keyhole Panda, TABCTENG, TEMP.Bottle, Poisoned Flight, TG-2754, and UNC2630. Its targets include telecommunications and technology companies, government organizations, and the defense sector, including United States defense industrial base organizations. The group specializes in compromising internet-facing remote-access and network appliances. Its operations include exploiting Pulse Secure VPN vulnerabilities, including CVE-2021-22893, and exploiting CVE-2022-27518 in Citrix ADC and Citrix Gateway appliances. Pulse Secure activity tracked as SlowPulse involved modifying shared software components to capture credentials and bypass authentication flows, including multifactor authentication. Associated techniques include deploying web shells and modifying appliance software to maintain persistent access. APT5 has maintained access to compromised telecommunications-sector VPN infrastructure for months. APT5 has also used the SPACEHOP operational relay box network for reconnaissance scanning and vulnerability exploitation. Such infrastructure routes activity through intermediary systems to obscure its origin. Infrastructure linked to Keyhole Panda/APT5 has additionally been associated with ChatGPT use for open-source research, reconnaissance, script modification, Linux troubleshooting, software development, and infrastructure configuration.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
101 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
17 malware families Mallory has associated with this actor across public reporting.
12 additional families tracked in Mallory.
13 CVEs Mallory has associated with this actor across public reporting. 13 of them are exploited in the wild (not necessarily by this actor).
7 more CVEs tied to this actor tracked in Mallory.
98 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.