APT17Threat actor
- aurora panda
- Axiom
- bronze keystone
- deputy dog
- dogfish
- g0001
- g0025
- group 72
- group 8
- heart typhoon
- helium
- hidden lynx
- tailgater team
FireEye described APT17 in a 2015 report as: 'APT17, also known as DeputyDog, is a China based threat group that FireEye Intelligence has observed conducting network intrusions against U. S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations.'From MISP Galaxy
Last reported 13 months ago, by Huntress3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1176.001Browser Extensions
“Browser extension: Various browser extensions like ad blockers, etc.”
- T1530Data from Cloud Storage
“…t, we have “multifunctional programs” with the help of which we can conduct examination of mobile devices, hard drives, extract data from cloud storages, and analyze the data extracted from all these sources.”
- T1564.014Extended Attributes
“_filename” files to ensure file system compatibility for storing of extended attributes.”
What the reports say
3 reports, newest first · the exact sentence from each-
An Attacker’s Blunder Gave Us a Look Into Their Operations“…or conducted a fair amount of research into tools used to scrape Telegram group data, including looking at scraper tools like Apify, the Axiom Chrome extension, and the RapidAPI platform (Figure 13).”
-
Unveiling USB Artifacts: A Comparative Analysis“Following each test, logical drive images (E01) of the USB drive were captured using FTK Imager (v 4.5.0.3) and analyzed with both Axiom v7.5.0 and Autopsy v4.21.0 forensic tools to examine and understand the artifacts left behind.”
-
Tools up: the best software and hardware tools for computer forensics“The undisputed leader in computer forensics is Magnet Axiom.”
Indicators in its reports
named in the reports above- login.incipientcroop[.]comin 1 report
Copy this indicator · defanged
Thanks — we review every report.