TianWu
- First seen
- 2018-06-01 00:00:00
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 11:48:19
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:us country_code:cn country_code:jp
Context
TianWu is a nation-state threat actor believed to operate from China, primarily focused on cyber-espionage targeting government and technology sectors in multiple countries.
Reports & references
- i.blackhat.com — As 22 Li To Loot Or Not To Loot That Is Not A Question (report)
- i.blackhat.com — As 22 Leonsilvia Nextgenplugxshadowpad (report)
- decoded.avast.io — Operation Dragon Castling Apt Group Targeting Betting Companies (report)
- github.com — Operationdragoncastling (report)