Tonto Team
Tonto Team is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 12 sectors, including Government and Technology, in 6 countries, including the United States and Japan. It uses 38 MITRE ATT&CK techniques and exploits 1 known CVE.
- Earth Akhlut
- BRONZE HUNTLEY
- Karma Panda
- CactusPete
- Origin
- China
- Techniques
- 38
- Exploited CVEs
- 1
- First seen
- Jan 1, 2009
- Last seen
- Mar 10, 2021
- Record updated
Who They Target.
About Tonto Team.
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.