APT20
APT20 is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 8 sectors, including Government and Technology, in 10 countries, including the United States and the United Kingdom. It uses 7 MITRE ATT&CK techniques.
- Violin Panda
- Crawling Taurus
- TH3Bug
- Twivy
- Origin
- China
- Techniques
- 7
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2011
- Last seen
- Dec 19, 2019
- Record updated
Who They Target.
About APT20.
APT20 is a China-based cyber-espionage group. Fox-IT's December 2019 report "Operation Wocao" describes two years of intrusions (December 2017 - December 2019) that Fox-IT attributes with high confidence to a Chinese group working in support of Chinese government interests, and with medium confidence to the actor the industry tracks as APT20; open reporting places APT20's activity since 2011 with a dormant period around 2016-2017. Victims were identified in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom and the United States, across government entities, managed service providers and industries including aviation, construction, gambling, energy, finance, health care, insurance, offshore engineering, payroll/HR services, physical lock manufacturing, software development and transportation.
Last updated Oct 14, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.