[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fq40UniYGXHRzFUaNAqP92T9uwE8VSFEdAAnjbWloiLU":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":11,"country":12,"suspected_sponsor":13,"target_industries":14,"target_countries":16,"incident_types":19,"references":21,"techniques":27,"technique_count":30,"created_at":31,"seoMetadata":32,"schemaOrg":36},"APT16","apt16",[9,10],"SVCMONDR","G0023","Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attacks targeting Japanese and Taiwanese organizations in the high-tech, government services, media and financial services industries. Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability, and the local Windows privilege escalation vulnerability CVE-2015-1701. The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO, or a backdoor that we refer to as ELMER.","CN","China",[15],"Private sector",[17,18],"Japan","Taiwan",[20],"Espionage",[22,23,24,25,26],"https:\u002F\u002Fwww.fireeye.com\u002Fblog\u002Fthreat-research\u002F2015\u002F12\u002Fthe_eps_awakens.html","https:\u002F\u002Fwww.cfr.org\u002Finteractive\u002Fcyber-operations\u002Fapt-16","https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0023","https:\u002F\u002Fwww.mandiant.com\u002Fresources\u002Finsights\u002Fapt-groups","https:\u002F\u002Fsecurelist.com\u002Fanalysis\u002Fpublications\u002F74828\u002Fcve-2015-2545-overview-of-current-threats\u002F",[28,29],"T1584","T1584.004",2,"2023-08-09T17:25:09.409843+00:00",{"title":33,"metaDescription":34,"keywords":35},"APT16 Threat Actor Profile | EdgeProtect","Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attacks targeting Japanese...","APT16, SVCMONDR, G0023, threat actor, APT, cyber threat, threat intelligence, Private sector, China, CN",{"@context":37,"@type":38,"name":6,"alternateName":39,"description":11,"url":40,"mainEntityOfPage":41,"location":43},"https:\u002F\u002Fschema.org","Organization",[9,10],"https:\u002F\u002Fdev.precursorintelligence.com\u002Fthreat-actors\u002Fapt16",{"@type":42,"@id":40},"WebPage",{"@type":44,"name":12},"Country"]