APT12

Executive Summary

APT12, a Chinese threat group, has been conducting espionage operations targeting various sectors, including telecommunications, critical infrastructure, and government. Their primary motivation is to gather sensitive information from high-tech companies, media outlets, and governments. APT12's activities have been observed in several countries, with a focus on Taiwan and Japan.

Goals & Targeting

APT12's strategic objectives are focused on gathering sensitive information from their targets, with a particular emphasis on critical infrastructure, telecommunications, and government sectors. The group's targeting profile suggests that they are interested in exploiting vulnerabilities in these sectors to gain access to sensitive information. APT12's typical victims are high-tech companies, media outlets, and governments, which are likely targeted due to their perceived value as sources of sensitive information.

APT12's operations have been linked to several campaigns, including the NYT Oct 2012 campaign. The group has also been associated with various software and tools, including Ixeshe, RIPTIDE, attrib, and HTRAN. APT12's use of these tools and techniques suggests that they are a well-resourced and organized threat group, capable of conducting complex and targeted attacks.

Key Capabilities

• Advanced spearphishing techniques
• DNS calculation and tunneling
• Exploitation of client applications
• Bidirectional communication
• Use of custom malware and tools

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

APT12's campaign patterns suggest that they are a well-organized and resourced threat group, capable of conducting complex and targeted attacks. The group's operational tempo is likely to be moderate to high, with a focus on exploiting vulnerabilities in critical infrastructure, telecommunications, and government sectors. APT12's notable past operations include the NYT Oct 2012 campaign, which targeted media outlets and high-tech companies.

IOC Patterns

• Spearphishing with macro-laced Office documents
• C2 over DNS using fast-flux
• Staging infrastructure on bulletproof hosting
• Use of custom malware and tools

Recommended Actions

• Implement robust email filtering and spearphishing detection
• Use DNS traffic monitoring and anomaly detection
• Implement least privilege and segregation of duties
• Conduct regular vulnerability assessments and patching
• Use endpoint detection and response tools

Suggested Tags