ctrlINT What the industry said about every indicator, with the quote

TickThreat actor

  • bronze butler
  • g0060
  • nian
  • pla unit 61419
  • redbaldknight
  • stalker panda
  • stalker taurus
  • swirl typhoon
  • temp.tick
  • tick castle

Tick is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group appears to have close ties to the Chinese National University of Defense and Technology, which is possibly linked to the PLA.From MISP Galaxy

Last reported 30 days ago, by Risky Business News2 reports

Suspected originChinaMISP Galaxy
Targets sectorsManufacturing, government, mediaMISP Galaxy
Targets countriesJapan, China, South Korea, RussiaMISP Galaxy

ATT&CK techniques

1 technique · each with the sentence it comes from
  1. T1497.001System Checks

    “In case of success, the system checks for batch files in the “/test” directory of “Yandex.Disk” (PROFIND).”

    Group-IBVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “Chinese and Russian APTs Are Using AI to Tick Different Boxes”

    Risky Business NewsNews
    Srsly Risky Biz: Bring On the AI Lawsuits

  2. “…nghai is responsible for the actions of a well-known group called APT1 (aka Comment Crew), and unit 61419 from Qingdao has been linked to Tick.”

    Group-IBVendor
    The Art of Cyberwarfare

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Tick here?
No account needed. We do not store your IP address.