APT16
Also known as SVCMONDR, G0023
Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attacks targeting Japanese and Taiwanese organizations in the high-tech, government services, media and financial services industries. Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability, and the local Windows privilege escalation vulnerability CVE-2015-1701. The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO, or a backdoor that we refer to as ELMER.
Targets: Private sector, Japan, Taiwan
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.fireeye.com/blog/threat-research/2015/12/the_eps_awakens.html
- https://www.cfr.org/interactive/cyber-operations/apt-16
- https://attack.mitre.org/groups/G0023
- https://www.mandiant.com/resources/insights/apt-groups
- https://securelist.com/analysis/publications/74828/cve-2015-2545-overview-of-current-threats/
- https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.