APT16
threat actorCNalso known as
Other names and identifiers for this entity.
ATT&CK
APT16
MISP
APT16 · SVCMONDR
Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attacks targeting Japanese and Taiwanese organizations in the high-tech, government services, media and financial services industries. Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability, and the local Windows privilege escalation vulnerability CVE-2015-1701. The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO, or a backdoor that we refer to as ELMER.
resolved ATT&CK groups
Threat groups associated with this.
techniques used (1)
ATT&CK techniques this enables or maps to.
software used (1)
Malware and tools associated with this.
references
External citations — patches, advisories, analysis.
- https://www.fireeye.com/blog/threat-research/2015/12/the_eps_awakens.html
- https://www.cfr.org/interactive/cyber-operations/apt-16
- https://attack.mitre.org/groups/G0023
- https://www.mandiant.com/resources/insights/apt-groups
- https://securelist.com/analysis/publications/74828/cve-2015-2545-overview-of-current-threats/