G0062 Unknownour call,
not MITRE’s ATT&CK Group

TA459

How MITRE ATT&CK characterizes this group¹: TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others.

Origin / sponsor: not established from a curated public advisory — see Coverage & confidence. Not asserted here.

Read this as · tier is our editorial call, not MITRE’s

Motivation not classified from the public record.

We could not place this actor into a coarse motivation tier from ATT&CK’s intrusion-set type and description prose. That uncertainty is itself a finding — the tradecraft below is still cited; the “why” is a coverage gap. All tradecraft below is sourced to MITRE ATT&CK.

Techniques

ATT&CK count¹

Named tools / malware

ATT&CK count²

Attributed campaigns

ATT&CK count¹

Tactics spanned

ATT&CK count¹

coverage gap

Activity bounds

no attributed campaign

Known for

— signature moves, each sourced to ATT&CK

ArsenalNamed tooling. ATT&CK attributes 4 tools/malware to this group, including PlugX, gh0st RAT, NetTraveler, ZeroT.⁸

ReachFurthest outcome. This actor's cited tradecraft reaches as far as outcome 1 — Front door — unauthenticated access. (editorial mapping over ATT&CK tactics).

Tradecraft heatmap

— ATT&CK techniques mapped onto the five attacker-outcome narratives

Each row is a documented technique (MITRE ATT&CK). Each column is one of the five attacker-outcome narratives a defender funds against. A filled cell means this technique’s own ATT&CK tactic defensibly advances that outcome. The mapping of technique→outcome is our editorial alignment over ATT&CK's tactic data, not a separately-sourced MITRE edge. A filled cell means one of the technique's own ATT&CK tactics defensibly advances that outcome; enabler tactics (C2, Defense Evasion, Discovery) heat no column.

1Front door

2Keys to the kingdom

3Lateral reach

4Data at risk

5Lights out

T1059.001 PowerShellExecution

●

T1059.005 Visual BasicExecution

●

T1203 Exploitation for Client ExecutionExecution

●

T1204.002 Malicious FileExecution

●

T1566.001 Spearphishing AttachmentInitial Access

●

Reach: this actor’s cited techniques light columns 1 — furthest is 1 · Front door. (furthest-position idiom, reused from the landing map).

A dot = this technique advances that outcomeColumn 2 (Keys to kingdom) is empty — Compare: a credential-theft / identity actor lights column 2.Column 3 (Lateral reach) is empty — Compare: a hands-on-keyboard intruder lights column 3.Column 4 (Data at risk) is empty — Compare: an espionage / data-theft actor lights column 4.Column 5 (Lights out) is empty — Compare: a ransomware or wiper actor lights column 5.

Editorial: the technique→outcome alignment is our call over ATT&CK’s tactic data, not a separately-sourced MITRE edge — same basis the landing page declares. Enabler tactics (C2, defense evasion, discovery) heat no column.¹

Arsenal

— named tools & malware ATT&CK attributes to this group

PlugXS0013 · Malware

ATT&CK S0013 ↗

gh0st RATS0032 · Malware

ATT&CK S0032 ↗

NetTravelerS0033 · Malware

ATT&CK S0033 ↗

ZeroTS0230 · Malware

ATT&CK S0230 ↗

Campaign highlights

— attributed operations in the ATT&CK record

No attributed campaigns — coverage gap

Stated, not hidden

ATT&CK lists no first-class campaign object for G0062 at this snapshot. Public reporting may tie this actor to operations; those enter only with a named advisory under the same cite-or-die rule.

Latest activity

— with explicit confidence, and what we cannot yet claim

ATT&CK
snapshot

The most recent cited activity in this card is the ATT&CK record itself. We do not paste a “last seen this week” line we cannot source. Recency from secondary reporting appears here only when attached to a named advisory.

ATT&CK snapshot, compiled 2026-06-22Coverage gap — live “currently active” status not asserted

CVE ↔ actor bridge — Known exploits / Linked CVEs every link below traces to a named source; tier is explicit

Inferred / reported — lower confidence, never headline attribution 2 link(s)

These are not confirmed attribution. An inferred link is a structural ATT&CK chain (this group uses a tool whose reference cites the CVE); it is back-cited to the original report and never claims the source names the group.

CVE-2015-5119 →

ATT&CK attributes gh0st RAT (S0032) to this group, and that software’s ATT&CK reference cites CVE-2015-5119. Structural chain — not a statement that the report names the group.

original report (cited on the ATT&CK software page) ↗

CVE-2017-0199 →

ATT&CK attributes ZeroT (S0230) to this group, and that software’s ATT&CK reference cites CVE-2017-0199. Structural chain — not a statement that the report names the group.

original report (cited on the ATT&CK software page) ↗

Coverage & confidence

— what we know, and what we don’t

Established (cited)

Group identity, aliases, description — MITRE ATT&CK group page

5 techniques — ATT&CK technique pages (linked per row)

4 software (arsenal) — ATT&CK software pages

1 third-party research citations — ATT&CK external references

Coverage gaps — stated, not hidden

Origin/sponsor not established from a curated public advisory. ATT&CK prose may imply attribution but is not asserted here — absence of a curated source is a coverage finding, not a clean bill of attribution.

Threat tier is OUR editorial classification (rule-based), not a MITRE field — labeled as such.

Technique → outcome heatmap is editorial alignment over ATT&CK tactic data, not a separately-sourced MITRE edge.

Activity bounds are a floor from attributed-campaign dates only — flagged approx., not a true active-since range.

ATT&CK has no first-class group→CVE relationship; this card asserts no specific CVE without a named advisory.

No attributed ATT&CK campaign object — activity bounds cannot be established.

Empty heatmap column(s): Keys to kingdom, Lateral reach, Data at risk, Lights out — consistent with this actor's nature, stated as a finding.