APT5
- ID
- G1023
- Associated names
- Mulberry Typhoon, MANGANESE, BRONZE FLEETWOOD, Keyhole Panda, UNC2630
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.[1][2][3][4][5][6]
Techniques used (29)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1021.001 Remote Desktop Protocol
- T1021.004 SSH
- T1036.005 Match Legitimate Resource Name or Location
- T1049 System Network Connections Discovery
- T1053.003 Cron
- T1055 Process Injection
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1070 Indicator Removal
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1074.001 Local Data Staging
- T1078.002 Domain Accounts
- T1078.004 Cloud Accounts
- T1083 File and Directory Discovery
- T1098.007 Additional Local or Domain Groups
- T1136.001 Local Account
- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1554 Compromise Host Software Binary
- T1560.001 Archive via Utility
- T1583.005 Botnet
- T1654 Log Enumeration
- T1685 Disable or Modify Tools
Software used (13)
- S0002 Mimikatz
- S0007 Skeleton Key
- S0012 PoisonIvy
- S0032 gh0st RAT
- S0039 Net
- S0057 Tasklist
- S0104 netstat
- S1050 PcShare
- S1104 SLOWPULSE
- S1108 PULSECHECK
- S1109 PACEMAKER
- S1110 SLIGHTPULSE
- S1113 RAPIDPULSE