ctrlINT What the industry said about every indicator, with the quote

Tonto TeamThreat actor

  • bronze huntley
  • cactuspete
  • earth akhlut
  • g0131
  • karma panda
  • lone castle
  • pla unit 65017
  • red beifang
  • tag-74

Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malware, including the Bisonal RAT and ShadowPad. They employ spear-phishing emails with malicious attachments as their preferred method of distribution.From MISP Galaxy

Last reported 3 years ago, by Group-IB1 report

Suspected originChinaMISP Galaxy
Targets sectorsDefence, governmentMISP Galaxy
Targets countriesJapan, South Korea, Taiwan, United StatesMISP Galaxy

ATT&CK techniques

6 of 21 · each with the sentence it comes from
  1. T1001Data Obfuscation

    “T1001 Data Obfuscation”

    Group-IBVendor
  2. T1016System Network Configuration Discovery

    “T1016 System Network Configuration Discovery”

    Group-IBVendor
  3. T1027Obfuscated Files or Information

    “T1027 Obfuscated Files or Information”

    Group-IBVendor
  4. T1033System Owner/User Discovery

    “T1033 System Owner/User Discovery”

    Group-IBVendor
  5. T1041Exfiltration Over C2 Channel

    “T1041 Exfiltration Over C2 Channel”

    Group-IBVendor
  6. T1057Process Discovery

    “T1057 Process Discovery”

    Group-IBVendor

What the reports say

1 report, newest first · the exact sentence from each

  1. “Nice Try Tonto Team”

    Group-IBVendor
    Nice Try Tonto Team

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Tonto Team here?
No account needed. We do not store your IP address.