FlagThis

← All Threat Actors
Threat Actor Profile

Tonto Team

BRONZE HUNTLEY CactusPete COPPER Earth Akhlut G0131 KARMA PANDA PLA Unit 65017 Red Beifang TAG-74
▲ High Threat
Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malware, including the Bisonal RAT and ShadowPad. They employ spear-phishing emails with malicious attachments as their preferred method of distribution.
Origin China
Sponsor China

Target Sectors

Military Government Private sector

Known TTPs

Network Share Discovery
DLL
External Proxy
Python
Local Groups
Keylogging
OS Credential Dumping
Web Shell
Exploitation for Client Execution
Malicious File
Spearphishing Attachment
Exploitation of Remote Services
PowerShell
Exploitation for Privilege Escalation
Ingress Tool Transfer

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD