admin@338
- ID
- G0018
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. [1]
Techniques used (12)
- T1007 System Service Discovery
- T1016 System Network Configuration Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1049 System Network Connections Discovery
- T1059.003 Windows Command Shell
- T1069.001 Local Groups
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1566.001 Spearphishing Attachment