旺刺
旺刺 is a nation-state APT group with an espionage motive, tracked by Brandefense. It uses 14 MITRE ATT&CK techniques.
Also known as
- APT-C-47
- Techniques
- 14
- Exploited CVEs
- No CVE data
- First seen
- Dec 15, 2020
- Last seen
- Dec 15, 2020
- Record updated
How They Operate · MITRE ATT&CK.
14 techniques across 8 of 14 tacticsResource Development·
Execution3
T1059
Command and Scripting Interpreter
Command and Scripting Interpreter
T1574.002
Hijack Execution Flow: DLL Side-Loading
Hijack Execution Flow: DLL Side-Loading
T1620
Reflective Code Loading
Reflective Code Loading
Persistence1
T1547.001
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation·
Defense Evasion1
T1027.003
Obfuscated Files or Information: Steganography
Obfuscated Files or Information: Steganography
Credential Access·
Discovery3
T1016
System Network Configuration Discovery
System Network Configuration Discovery
T1083
File and Directory Discovery
File and Directory Discovery
T1518.001
Software Discovery: Security Software Discovery
Software Discovery: Security Software Discovery
Lateral Movement·
Collection·
Command and Control1
T1573.002
Encrypted Channel: Asymmetric Cryptography
Encrypted Channel: Asymmetric Cryptography
Exfiltration1
T1041
Exfiltration Over C2 Channel
Exfiltration Over C2 Channel
Impact·
Indicators Of Compromise.
TLP:AMBER34 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout 旺刺.
An undisclosed APT group from the Korean Peninsula region, active since at least 2018 per Qihoo 360, targeting organisations and individuals connected to the peninsula with ClickOnce lures and C# and Go backdoors.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.