← All Threat Actors
Threat Actor Profile

Confucius

Confucius APT G0142
Confucius (G0142) is a Chinese state-sponsored threat actor primarily engaged in strategic espionage targeting government, diplomatic, and military entities, with a strong focus on Southeast Asia. While specific high-profile campaigns attributed solely to this actor have decreased in public reporting over the last 18 months, its activity is viewed as part of the broader PRC intelligence-gathering ecosystem.
Origin China
Sponsor People's Republic of China (PRC)
Motivation Strategic intelligence collection and political espionage

Target Sectors

Government Diplomatic Missions Military Education Southeast Asian Regional Organizations

Known TTPs

Spear-phishing with malicious attachments
Use of custom backdoors (Confucius malware family)
DLL side-loading
Credential harvesting
Living-off-the-land (LotL) binaries
Exploitation of public-facing vulnerabilities

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD