Tonto Team
- ID
- G0131
- Associated names
- Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).[1][2][3][4][5][6]
Techniques used (15)
- T1003 OS Credential Dumping
- T1056.001 Keylogging
- T1059.001 PowerShell
- T1059.006 Python
- T1068 Exploitation for Privilege Escalation
- T1069.001 Local Groups
- T1090.002 External Proxy
- T1105 Ingress Tool Transfer
- T1135 Network Share Discovery
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1210 Exploitation of Remote Services
- T1505.003 Web Shell
- T1566.001 Spearphishing Attachment
- T1574.001 DLL