Threat actor · G0131

Tonto Team

Earth AkhlutBRONZE HUNTLEYCactusPeteKarma Panda

UnattributedNo public state or group attribution on record

Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).

MITRE ATT&CK Techniques

T1003 T1056.001 T1059.001 T1059.006 T1068 T1069.001 T1090.002 T1105 T1135 T1203 T1204.002 T1210 T1505.003 T1566.001 T1574.001

Associated Malware

BisonalLaZagneMimikatzNBTscanShadowPadgsecdump

Full MITRE ATT&CK profile

0 recent articles mention this actor

No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.