G1023 Nation-stateour call,
not MITRE’s ATT&CK Group

APT5

How MITRE ATT&CK characterizes this group¹: APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.

Origin / sponsor: not established from a curated public advisory — see Coverage & confidence. Not asserted here.

Also tracked as: Mulberry Typhoon MANGANESE BRONZE FLEETWOOD Keyhole Panda UNC2630 — ATT&CK group page¹

Read this as · tier is our editorial call, not MITRE’s

Read as a state-directed operator, not a smash-and-grab.

A nation-state classification means patience, tradecraft, and an intelligence objective. When this name attaches to a vulnerability, the question shifts from “will someone exploit it” to “has a well-resourced service already built it into an operation.” All tradecraft below is sourced to MITRE ATT&CK.

Techniques

ATT&CK count¹

Named tools / malware

ATT&CK count²

Attributed campaigns

ATT&CK count¹

Tactics spanned

ATT&CK count¹

~2019–2024approx.

Activity bounds (campaign floor)

approximate¹

Known for

— signature moves, each sourced to ATT&CK

CampaignSPACEHOP Activity. ATT&CK tracks this attributed operation as C0052.⁴⁵

ArsenalNamed tooling. ATT&CK attributes 13 tools/malware to this group, including Mimikatz, Skeleton Key, PoisonIvy, gh0st RAT.³²

ReachFurthest outcome. This actor's cited tradecraft reaches as far as outcome 4 — Data at risk — exfiltration. (editorial mapping over ATT&CK tactics).

Tradecraft heatmap

— ATT&CK techniques mapped onto the five attacker-outcome narratives

Each row is a documented technique (MITRE ATT&CK). Each column is one of the five attacker-outcome narratives a defender funds against. A filled cell means this technique’s own ATT&CK tactic defensibly advances that outcome. The mapping of technique→outcome is our editorial alignment over ATT&CK's tactic data, not a separately-sourced MITRE edge. A filled cell means one of the technique's own ATT&CK tactics defensibly advances that outcome; enabler tactics (C2, Defense Evasion, Discovery) heat no column.

1Front door

2Keys to the kingdom

3Lateral reach

4Data at risk

5Lights out

T1003.001 LSASS MemoryCredential Access

●

T1003.002 Security Account ManagerCredential Access

●

T1021.001 Remote Desktop ProtocolLateral Movement

●

T1021.004 SSHLateral Movement

●

T1036.005 Match Legitimate Resource Name or LocationDefense Evasion

T1049 System Network Connections DiscoveryDiscovery

T1053.003 CronExecution / Persistence / Privilege Escalation

●

T1055 Process InjectionPrivilege Escalation / Defense Evasion

●

T1056.001 KeyloggingCredential Access / Collection

●

T1057 Process DiscoveryDiscovery

T1059.001 PowerShellExecution

●

T1059.003 Windows Command ShellExecution

●

T1070 Indicator RemovalDefense Evasion

T1070.003 Clear Command HistoryDefense Evasion

T1070.004 File DeletionDefense Evasion

T1070.006 TimestompDefense Evasion

T1074.001 Local Data StagingCollection

●

T1078.002 Domain AccountsInitial Access / Persistence / Privilege Escalation / Defense Evasion

●

T1078.004 Cloud AccountsInitial Access / Persistence / Privilege Escalation / Defense Evasion

●

T1083 File and Directory DiscoveryDiscovery

T1098.007 Additional Local or Domain GroupsPersistence / Privilege Escalation

●

T1136.001 Local AccountPersistence

●

T1190 Exploit Public-Facing ApplicationInitial Access

●

T1505.003 Web ShellPersistence

●

T1554 Compromise Host Software BinaryPersistence

●

T1560.001 Archive via UtilityCollection

●

T1562.006 Indicator BlockingDefense Evasion

T1583.005 BotnetResource Development

T1654 Log EnumerationDiscovery

Reach: this actor’s cited techniques light columns 1·2·3·4 — furthest is 4 · Data at risk. (furthest-position idiom, reused from the landing map).

A dot = this technique advances that outcomeColumn 5 (Lights out) is empty — Compare: a ransomware or wiper actor lights column 5.

Editorial: the technique→outcome alignment is our call over ATT&CK’s tactic data, not a separately-sourced MITRE edge — same basis the landing page declares. Enabler tactics (C2, defense evasion, discovery) heat no column.¹

Arsenal

— named tools & malware ATT&CK attributes to this group

MimikatzS0002 · Tool

ATT&CK S0002 ↗

Skeleton KeyS0007 · Malware

ATT&CK S0007 ↗

PoisonIvyS0012 · Malware

ATT&CK S0012 ↗

gh0st RATS0032 · Malware

NetS0039 · Tool

TasklistS0057 · Tool

netstatS0104 · Tool

PcShareS1050 · Tool

+5 moreCoverage

ATT&CK attributes 13 tools/malware to G1023 in total; the full list is on the group page.

ATT&CK G1023 ↗

Campaign highlights

— attributed operations in the ATT&CK record

SPACEHOP Activity — ATT&CK Campaign C0052

Attributed operation

ATT&CK records SPACEHOP Activity (C0052) — roughly 2019–2024 as an operation attributed to this group.⁴⁵

Open ATT&CK C0052 ↗

Latest activity

— with explicit confidence, and what we cannot yet claim

ATT&CK
snapshot

The most recent cited activity in this card is the ATT&CK record itself. We do not paste a “last seen this week” line we cannot source. Recency from secondary reporting appears here only when attached to a named advisory.

ATT&CK snapshot, compiled 2026-06-22Coverage gap — live “currently active” status not asserted

CVE ↔ actor bridge — Known exploits / Linked CVEs every link below traces to a named source; tier is explicit

Inferred / reported — lower confidence, never headline attribution 1 link(s)

These are not confirmed attribution. An inferred link is a structural ATT&CK chain (this group uses a tool whose reference cites the CVE); it is back-cited to the original report and never claims the source names the group.

CVE-2015-5119 →

ATT&CK attributes gh0st RAT (S0032) to this group, and that software’s ATT&CK reference cites CVE-2015-5119. Structural chain — not a statement that the report names the group.

original report (cited on the ATT&CK software page) ↗

Coverage & confidence

— what we know, and what we don’t

Established (cited)

Group identity, aliases, description — MITRE ATT&CK group page

29 techniques — ATT&CK technique pages (linked per row)

13 software (arsenal) — ATT&CK software pages

1 attributed campaign(s) — ATT&CK campaign pages

8 third-party research citations — ATT&CK external references

Coverage gaps — stated, not hidden

Origin/sponsor not established from a curated public advisory. ATT&CK prose may imply attribution but is not asserted here — absence of a curated source is a coverage finding, not a clean bill of attribution.

Threat tier is OUR editorial classification (rule-based), not a MITRE field — labeled as such.

Technique → outcome heatmap is editorial alignment over ATT&CK tactic data, not a separately-sourced MITRE edge.

Activity bounds are a floor from attributed-campaign dates only — flagged approx., not a true active-since range.

ATT&CK has no first-class group→CVE relationship; this card asserts no specific CVE without a named advisory.

Empty heatmap column(s): Lights out — consistent with this actor's nature, stated as a finding.