APT40

Actor Type	Nation State
Attributed to Nation	China
Directly Linked Intrusion Sets	Leviathan
Associated Threat Actor	Hainan Xiandun Technology Development Company , Hainan State Security Department , Chinese Ministry of State Security

APT40 is a threat actor originally identified by researchers at Mandiant an attributed to the Chinese government. A 2021 US Department of Justice indictment linked the group to the Hainan State Security Department (HSSD), a provincial arm of China’s Ministry of State Security (MSS).

According to researchers at Mandiant, the group has been observed targeting organizations globally, with a focus on countries that are strategically important to the Belt and Road Initiative.

APT40 have a complex arsenal of public and private tools, some of which are shared with other China attributed threat actors. APT40 typically gain access via spear-phishing including masquerading as prominent individuals and leveraging previously compromised accounts for this purpose.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

APT40 Threat Reports

Report

APT40 Advisory - PRC MSS tradecraft in action

This advisory, authored by the Australian Cyber Security Centre and multiple other international cybersecurity agencies, outlines the threat posed ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

Search:

ATT&CK ID	Title	Associated Tactics
T1027.003	Steganography	Defense Evasion
T1190	Exploit Public-Facing Application	Initial Access
T1047	Windows Management Instrumentation	Execution
T1105	Ingress Tool Transfer	Command and Control
T1053.005	Scheduled Task	Execution, Persistence, Privilege Escalation
T1021.006	Windows Remote Management	Lateral Movement
T1539	Steal Web Session Cookie	Credential Access
T1010	Application Window Discovery	Discovery
T1212	Exploitation for Credential Access	Credential Access
T1112	Modify Registry	Defense Evasion
T1587.003	Digital Certificates	Resource Development
T1587.001	Malware	Resource Development
T1046	Network Service Discovery	Discovery
T1203	Exploitation for Client Execution	Execution
T1070.004	File Deletion	Defense Evasion
T1041	Exfiltration Over C2 Channel	Exfiltration
T1187	Forced Authentication	Credential Access
T1090.003	Multi-hop Proxy	Command and Control
T1027.002	Software Packing	Defense Evasion
T1001.003	Protocol Impersonation	Command and Control
T1590.001	Domain Properties	Reconnaissance
T1036	Masquerading	Defense Evasion
T1222.001	Windows File and Directory Permissions Modification	Defense Evasion
T1102.003	One-Way Communication	Command and Control
T1087.003	Email Account	Discovery
T1583	Acquire Infrastructure	Resource Development
T1572	Protocol Tunneling	Command and Control
T1074.001	Local Data Staging	Collection
T1055.001	Dynamic-link Library Injection	Defense Evasion, Privilege Escalation
T1049	System Network Connections Discovery	Discovery
T1137.001	Office Template Macros	Persistence
T1552.001	Credentials In Files	Credential Access
T1135	Network Share Discovery	Discovery
T1218.010	Regsvr32	Defense Evasion
T1070.001	Clear Windows Event Logs	Defense Evasion
T1055.003	Thread Execution Hijacking	Defense Evasion, Privilege Escalation
T1547.001	Registry Run Keys / Startup Folder	Persistence, Privilege Escalation
T1204.002	Malicious File	Execution
T1069.002	Domain Groups	Discovery
T1555.001	Keychain	Credential Access
T1595.002	Vulnerability Scanning	Reconnaissance
T1040	Network Sniffing	Credential Access, Discovery
T1059.003	Windows Command Shell	Execution
T1039	Data from Network Shared Drive	Collection
T1027	Obfuscated Files or Information	Defense Evasion
T1056.001	Keylogging	Collection, Credential Access
T1036.004	Masquerade Task or Service	Defense Evasion
T1078	Valid Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1546.004	Unix Shell Configuration Modification	Persistence, Privilege Escalation
T1497.001	System Checks	Defense Evasion, Discovery

Showing 1 to 50 of 159 entries

APT40

Cyber Threat Graph Context

APT40 Threat Reports

APT40 Advisory - PRC MSS tradecraft in action

References

www.cyber.gov.au

www.mandiant.com

cloud.google.com

www.cisa.gov

blog.sekoia.io

www.justice.gov

MITRE ATT&CK Techniques