← All Threat Actors
Threat Actor Profile

APT18

DYNAMITE PANDA G0026 PLA Navy Satin Typhoon SCANDIUM TG-0416 Threat Group-0416 Wekby
▲ High Threat
Wekby was described by Palo Alto Networks in a 2015 report as: 'Wekby is a group that has been active for a number of years, targeting various industries such as healthcare, telecommunications, aerospace, defense, and high tech. The group is known to leverage recently released exploits very shortly after those exploits are available, such as in the case of HackingTeams Flash zero - day exploit.'
Origin China
Sponsor China
Motivation Espionage

Target Sectors

Government Private sector Civil society Aerospace Defense Health High tech Telecoms

Known TTPs

Valid Accounts
Encrypted/Encoded File
External Remote Services
File Deletion
At
Ingress Tool Transfer
DNS
System Information Discovery
Web Protocols
File and Directory Discovery
Windows Command Shell
Registry Run Keys / Startup Folder

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD