Cyber threats / Threat actors

Tonto Team

CN Suspected sponsor: China · ATT&CK G0131
3
APAC targets
15
Techniques
0
Incidents
0
News · 30d
Profile
Also known as: BRONZE HUNTLEY, CactusPete, COPPER, Earth Akhlut, G0131, KARMA PANDA, LONE CASTLE, PLA Unit 65017, Red Beifang, TAG-74

Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malware, including the Bisonal RAT and ShadowPad. They employ spear-phishing emails with malicious attachments as their preferred method of distribution.

ATT&CK techniques · 15
Initial Access
Execution
Persistence
Privilege Escalation
Credential Access
Discovery
Lateral Movement
Command and Control
Incidents attributed
  • No incident in the register is attributed to this actor.
In the news
Targets
Elsewhere: United States
Sectors: Government, Military, Private sector
Relevance to the EU
EU relevance: Medium
Targets military in Japan, where the EU has Peace & Security projects; 1 more such overlap
14 EU cooperation projects in the Asia-Pacific countries this actor targets:
Research & Innovation
4
Trade & Investment
3
Digital & ICT
3
Peace & Security
1
Energy & Green Transition
1
Education & Skills
1
Development Cooperation
1
Threats to the EU →
References
Sources: MISP, MITRE