Skip to content
brandefense.io
Request A Demo
CybercrimeFinancialAdvanced sophistication

ETSO

ETSO is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets organisations in 6 countries, including the United States and Germany. It uses 16 MITRE ATT&CK techniques.

Also known as
  • ETSO Hacking Group
  • ETSO Attack Group
Request IOC feedRequest ATT&CK export
Techniques
16
Exploited CVEs
No CVE data
First seen
Dec 20, 2013
Last seen
Dec 20, 2013
Record updated

Who They Target.

Countries · 6

How They Operate · MITRE ATT&CK.

16 techniques across 8 of 14 tactics

Reconnaissance·

Resource Development1

T1195.002
Supply Chain Compromise: Compromise Software Supply Chain

Initial Access3

T1505.003
Server Software Component: Web Shell
T1566.001
Phishing: Spearphishing Attachment
T1566.002
Phishing: Spearphishing Link

Execution3

T1053.005
Scheduled Task/Job: Scheduled Task
T1542.003
Pre-OS Boot: Bootkit
T1574.002
Hijack Execution Flow: DLL Side-Loading

Persistence1

T1550.002
Use Alternate Authentication Material: Pass the Hash

Privilege Escalation·

Defense Evasion4

T1070.001
Indicator Removal: Clear Windows Event Logs
T1070.004
Indicator Removal: File Deletion
T1553.002
Subvert Trust Controls: Code Signing
T1560.002
Archive Collected Data: Archive via Library

Credential Access2

T1003.001
OS Credential Dumping: LSASS Memory
T1056.001
Input Capture: Keylogging

Discovery·

Lateral Movement1

T1021.002
Remote Services: SMB/Windows Admin Shares

Collection·

Command and Control·

Exfiltration1

T1048
Exfiltration Over Alternative Protocol

Impact·

Arsenal · Malware And Tools.

  • gsecdumptool
  • Mimikatztool
  • Wevtutiltool
  • Windows Credentials Editortool

Campaigns.

  1. ETSO Online Gaming Espionage and Cyber Money Theft CampaignDec 2013

Indicators Of Compromise.

TLP:AMBER

2 indicators on the Brandefense platform

IP, domain and hash indicators · YARA rules · ATT&CK Navigator export

Request A Demo

About ETSO.

A financially motivated cyber threat group originating from China, closely associated with the Winnti umbrella, that targeted the online gaming industry and software update mechanisms across South Korea and other regions.

Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.