APT18
Also known as DYNAMITE PANDA, TG-0416, SCANDIUM, PLA Navy, Wekby, G0026, Satin Typhoon
Wekby was described by Palo Alto Networks in a 2015 report as: 'Wekby is a group that has been active for a number of years, targeting various industries such as healthcare, telecommunications, aerospace, defense, and high tech. The group is known to leverage recently released exploits very shortly after those exploits are available, such as in the case of HackingTeams Flash zero - day exploit.'
Targets: Government, Private sector, Civil society, United States
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://threatpost.com/apt-gang-branches-out-to-medical-espionage-in-community-health-breach/107828
- https://www.cfr.org/interactive/cyber-operations/apt-18
- https://attack.mitre.org/groups/G0026
- https://www.mandiant.com/resources/insights/apt-groups
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.