APT19

Overview

APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. Some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same.

Naming & attribution

APT19 is tracked under 5 names across the industry. It uses 21 documented ATT&CK techniques — more than 54% of the 174 groups tracked here.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Sidewinder India — 11 shared techniques (28% overlap)
• Gorgon Group Pakistan — 8 shared techniques (28% overlap)
• Higaisa South Korea — 10 shared techniques (26% overlap)
• Inception Russia — 9 shared techniques (26% overlap)
• TA551 — 7 shared techniques (25% overlap)
• APT32 Vietnam — 19 shared techniques (24% overlap)

Targets

Finance · Military · Non-profit Organisation · Private sector · Technology

Regions

United States

TTPs — 21 techniques across 8 tactics

Tools & malware (2)

Cobalt Strike · Empire

Reporting (3)

• Privileges and Credentials: Phished at the Request of Counsel — Ahl, I
• ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts — Scott, J. and Spaniel, D
• New Attacks Linked to C0d0so0 Group — Grunzweig, J., Lee, B