APT17
MITRE ATT&CK: G0025 View on attack.mitre.org
Aliases: Deputy Dog, Group 8, AURORA PANDA, Hidden Lynx, Tailgater Team, Dogfish, BRONZE KEYSTONE, Group 72, Axiom, HELIUM, Heart Typhoon, APT17, ATG3, Red Typhoon, KAOS, TG-8153, SportsFans, DeputyDog, Tailgater
- First seen
- 2014-01-01 00:00:00
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- Espionage
- Related IoCs
- 22 (19 malicious)
- Last IoC activity
- 2026-10-18 00:40:13
- Profile updated
- 2026-07-07 12:31:40
Targeted industries: defense-and-aerospace government-and-public-sector technology-and-telecommunications professional-services education-and-nonprofits
Targeted regions: country_code:us
Context
APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations.
Recent IoC activity
19 malicious indicators in Maltiverse are attributed to APT17 (G0025). The 19 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| hostname | officecdn-microsoft-com.akamaixed.net | 2026-10-18 | 1 |
| hostname | exchange.openmd5.com | 2026-10-17 | 2 |
| hostname | exchange.portomnail.com | 2026-10-17 | 1 |
| hostname | microsoftcontents.com | 2026-10-16 | 1 |
| hostname | www.microsoftcontents.com | 2026-10-16 | 1 |
| hostname | mirros.microsoftcontents.com | 2026-10-15 | 1 |
| hostname | dash.tcplog.com | 2026-10-12 | 1 |
| hostname | fonts.google-au.ga | 2026-10-11 | 1 |
| hostname | ns1.xxe.pw | 2026-10-10 | 1 |
| hostname | help.tcplog.com | 2026-10-09 | 1 |
| hostname | linuxupdate.info | 2026-10-05 | 3 |
| file sample | SiteAdv.exe | 2026-10-04 | 3 |
| hostname | q4.xxe.pw | 2026-10-04 | 1 |
| hostname | cdn.google-au.ga | 2026-10-03 | 1 |
| hostname | x.xxe.pw | 2026-10-03 | 1 |
| hostname | qq.xxe.pw | 2026-10-03 | 1 |
| hostname | static.tcplog.com | 2026-09-26 | 1 |
| hostname | mirros3.linuxupdate.info | 2026-09-24 | 1 |
| hostname | mail.xxe.pw | 2026-09-19 | 1 |
Detection coverage
- 1 YARA rules
Malware & tools used
- Web Services (attack-pattern)
- Establish Accounts (attack-pattern)
- BLACKCOFFEE (malware)
Exploited vulnerabilities
- CVE-2013-3893 (vulnerability)
Related threat objects
- Winnti Group (threat-actor)
- Axiom (threat-actor)
- APT41 (threat-actor)
Reports & references
- raw.githubusercontent.com — Microsoftmapping (report)
- Mandiant — Apt17 Report (report)
- Mandiant — Apt Groups (report)
- web.archive.org — Operation Deputydog Zero Day Cve 2013 3893 Attack Against Japanese Targets (report)
- paper.seebug.org — Hidden Lynx (report)
- cfr.org — Apt 17 (report)
- carbonblack.com — Bit9 And Our Customers Security (report)
- web.archive.org — Security Vendors Take Action Against Hidden Lynx Malware (report)
- web.archive.org — Hidden Lynx Professional Hackers Hire (report)
- recordedfuture.com — Hidden Lynx Analysis (report)
- secureworks.com — Bronze Keystone (report)
- MITRE ATT&CK — G0025 (report)
- cfr.org — Axiom (report)
- MITRE ATT&CK — G0001 (report)
- youtube.com — Watch (report)