Skip to content
Threat actors by attributed origin

China-Attributed Threat Actors.

Brandefense tracks 193 threat actors attributed to China. The most documented are APT41, Mustang Panda and GhostEmperor. The sectors they target most are Government, Technology and Manufacturing.

24 of 193 published profiles shown

APT41China
aka Wicked Panda · Brass Typhoon · BARIUM +2
Nation-state APTIdeology

APT41 is a China-attributed nation-state APT group with an ideological motive.

172TTPs
29exploited
124malware
StrategicProfile →
Mustang PandaChina
aka TA416 · RedDelta · BRONZE PRESIDENT +8
Nation-state APTIdeology

Mustang Panda is a China-attributed nation-state APT group with an ideological motive.

175TTPs
13exploited
106malware
AdvancedProfile →
GhostEmperorChina
aka FamousSparrow · Earth Estrie · UNC2286 +4
Nation-state APTEspionage

GhostEmperor is a China-attributed nation-state APT group with an espionage motive.

140TTPs
47exploited
67malware
StrategicProfile →
Volt TyphoonChina
aka BRONZE SILHOUETTE · Vanguard Panda · DEV-0391 +4
Nation-state APTIdeology

Volt Typhoon is a China-attributed nation-state APT group with an ideological motive.

128TTPs
44exploited
35malware
AdvancedProfile →
Earth LuscaChina
aka TAG-22 · Charcoal Typhoon · CHROMIUM +1
Nation-state APTEspionage

Earth Lusca is a China-attributed nation-state APT group with an espionage motive.

93TTPs
37exploited
83malware
AdvancedProfile →
menuPassChina
aka Cicada · POTASSIUM · Stone Panda +5
Nation-state APTEspionage

menuPass is a China-attributed nation-state APT group with an espionage motive.

100TTPs
22exploited
75malware
AdvancedProfile →
UNC3886China
Nation-state APTIdeology

UNC3886 is a China-attributed nation-state APT group with an ideological motive.

99TTPs
13exploited
26malware
AdvancedProfile →
Aquatic PandaChina
aka Bronze University · G0143
Nation-state APTEspionage

Aquatic Panda is a China-attributed nation-state APT group with an espionage motive.

80TTPs
19exploited
29malware
AdvancedProfile →
ChimeraChina
aka CUTR · Chimera Under the Radar
Nation-state APTEspionage

Chimera is a China-attributed nation-state APT group with an espionage motive.

92TTPs
2exploited
17malware
AdvancedProfile →
Ke3changChina
aka APT15 · Mirage · Vixen Panda +5
Nation-state APTEspionage

Ke3chang is a China-attributed nation-state APT group with an espionage motive.

88TTPs
2exploited
31malware
AdvancedProfile →
LeviathanChina
aka MUDCARP · Kryptonite Panda · Gadolinium +12
Nation-state APTEspionage

Leviathan is a China-attributed nation-state APT group with an espionage motive.

78TTPs
9exploited
33malware
AdvancedProfile →
APT3China
aka Gothic Panda · Pirpi · UPS Team +13
Nation-state APTEspionage

APT3 is a China-attributed nation-state APT group with an espionage motive.

74TTPs
10exploited
16malware
AdvancedProfile →
Lotus BlossomChina
aka DRAGONFISH · Spring Dragon · RADIUM +1
Nation-state APTIdeology

Lotus Blossom is a China-attributed nation-state APT group with an ideological motive.

76TTPs
7exploited
19malware
AdvancedProfile →
BRONZE BUTLERChina
aka REDBALDKNIGHT · Tick · Stalker Panda +9
Nation-state APTIdeology

BRONZE BUTLER is a China-attributed nation-state APT group with an ideological motive.

70TTPs
10exploited
38malware
AdvancedProfile →
Silk TyphoonChina
aka Operation Exchange Marauder · Hafnium · Red Dev 13 +2
Nation-state APTIdeology

Silk Typhoon is a China-attributed nation-state APT group with an ideological motive.

61TTPs
17exploited
17malware
AdvancedProfile →
Violet TyphoonChina
aka APT31 · ZIRCONIUM · Judgment Panda +5
Nation-state APTIdeology

Violet Typhoon is a China-attributed nation-state APT group with an ideological motive.

73TTPs
2exploited
62malware
AdvancedProfile →
Tropic TrooperChina
aka Pirate Panda · KeyBoy · Earth Centaur +5
Nation-state APTEspionage

Tropic Trooper is a China-attributed nation-state APT group with an espionage motive.

64TTPs
8exploited
42malware
AdvancedProfile →
RockeChina
aka Iron Group · Aged Libra · G0106
CybercrimeFinancial

Rocke is a China-attributed cybercrime syndicate with a financial motive.

59TTPs
10exploited
15malware
AdvancedProfile →
WinntiChina
aka Blackfly · Winnti Umbrella · Winnti Group
Nation-state APTIdeology

Winnti is a China-attributed nation-state APT group with an ideological motive.

50TTPs
15exploited
23malware
AdvancedProfile →
ToddyCatChina
aka Storm-0247 · Operation “Stayin’ Alive”
Nation-state APTEspionage

ToddyCat is a China-attributed nation-state APT group with an espionage motive.

54TTPs
7exploited
23malware
AdvancedProfile →
MirrorFaceChina
aka Earth Kasha · Operation LiberalFace · Operation “AkaiRyū”
Nation-state APTEspionage

MirrorFace is a China-attributed nation-state APT group with an espionage motive.

47TTPs
9exploited
29malware
AdvancedProfile →
TeamTNTChina
aka (not Set) · Aoqin Dragon · UNC94 +1
CybercrimeFinancial

TeamTNT is a China-attributed cybercrime syndicate with a financial motive.

51TTPs
4exploited
19malware
AdvancedProfile →
Velvet AntChina
Nation-state APTEspionage

Velvet Ant is a China-attributed nation-state APT group with an espionage motive. It targets 3 sectors, including Technology and Manufacturing, in China.

48TTPs
2exploited
15malware
AdvancedProfile →
Night DragonChina
aka G0014
Nation-state APTEspionage

Night Dragon is a China-attributed nation-state APT group with an espionage motive.

48TTPs
–No CVE data
8malware
IntermediateProfile →
On the Brandefense platform

IOC Feeds, YARA Rules And ATT&CK Navigator Exports For Every Actor.

Plus alerts when an actor in your sector starts exploiting a product you run, and detection rules you can load into your own tools.

Request A Demo

FAQ

Common Questions.