Also known as: G0039, Suckfly, BRONZE OLIVE, Group 46, tracked as, Destroy RAT, Kaba, Korplug, several other aliases, Turbine Panda, mid-2015, Sandworm Team, Operation Cleaver, Shell Crew, WebMasters, KungFu Kittens, PinkPanther, a separate entity, APT28, VOLTZITE, for follow-on operations, APT36, Shadow Brokers, JerseyMikes, TURBINE PANDA, BRONZE EXPRESS, TECHNETIUM, Taffeta Typhoon
**Toolset/Malware:** China Chopper **Notes:** Possible overlap with Beijing Group
Targeted Sectors
Targeted Countries / Regions
Executive Summary
APT22 is a nation-state threat actor primarily involved in espionage activities. The group targets defense and aerospace sectors in the US and NATO countries, using tools like China Chopper for web-based attacks. APT22's operations have been ongoing since at least 2014, with a focus on maintaining persistent access through webshells.
Goals & Targeting
APT22's strategic objectives center around espionage, aiming to acquire sensitive information from the defense sector. The targeting profile reflects a focus on countries that are adversaries of China, including the US and NATO nations, to gain military and technological intelligence.
Enhanced Description
APT22, also known as G0039, Suckfly, and BRONZE OLIVE, is a nation-state-sponsored cyber espionage group. The actor primarily targets defense and aerospace organizations in the US and NATO member states. APT22's modus operandi involves using webshells like China Chopper to gain initial access and maintain persistence in targeted networks. The group exhibits extensive campaign history dating back to at least 2014, with a focus on stealing sensitive data and intellectual property from defense contractors.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
APT22 has been involved in multiple espionage campaigns targeting defense contractors. The group operates with a slow and methodical approach, focusing on maintaining long-term access to networks to steal sensitive data.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
High confidence in APT22's nation-state designation and espionage focus, though specific campaign details remain limited.
No campaigns linked yet.
No observed data linked yet.
7
Techniques
46
Tools
0
Campaigns
12
IOCs
0
Observed Data
7
Tactics