# APT5: threat group profile > APT5 is a threat group. Public reporting links it to 21 attack techniques. This free profile shows how it works, stage by stage, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it. Canonical page: https://www.edgeprotect.io/threat-actors/apt5 Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > APT5 ## At a glance | Fact | Value | |---|---| | Attack techniques | 21 (plus 19 sub-techniques) | | Thought to operate from | Not known | | Other names | 6 | | Public reports | 6 | ## Who is APT5? APT5 is a threat group. Public reporting links it to 21 attack techniques. ### Also known as KEYHOLE PANDA, MANGANESE, BRONZE FLEETWOOD, TEMP.Bottle, Mulberry Typhoon, Poisoned Flight Security companies each give the same group their own name, so one group can have many. ### What public reporting says > We have observed one APT group, which we call APT5, particularly focused on telecommunications and technology companies. More than half of the organizations we have observed being targeted or breached by APT5 operate in these sectors. Several times, APT5 has targeted organizations and personnel based in Southeast Asia. APT5 has been active since at least 2007. It appears to be a large threat group that consists of several subgroups, often with distinct tactics and infrastructure. APT5 has targeted or breached organizations across multiple industries, but its focus appears to be on telecommunications and technology companies, especially information about satellite communications. APT5 targeted the network of an electronics firm that sells products for both industrial and military applications. The group subsequently stole communications related to the firm’s business relationship with a national military, including inventories and memoranda about specific products they provided. In one case in late 2014, APT5 breached the network of an international telecommunications company. The group used malware with keylogging capabilities to monitor the computer of an executive who manages the company’s relationships with other telecommunications companies ## How does APT5 attack? Stage by stage Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 21 linked to APT5. Some techniques belong to more than one stage. Public reporting also lists 19 more specific variations of them, called sub-techniques. ### 1. Research (0) - None linked in public reporting. ### 2. Preparation (0) - None linked in public reporting. ### 3. Getting in (2) - T1078: Valid Accounts - T1190: Exploit Public-Facing Application ### 4. Running code (2) - T1053: Scheduled Task/Job - T1059: Command and Scripting Interpreter ### 5. Staying in (6) - T1053: Scheduled Task/Job - T1078: Valid Accounts - T1098: Account Manipulation - T1136: Create Account - T1505: Server Software Component - T1554: Compromise Host Software Binary ### 6. Taking control (4) - T1053: Scheduled Task/Job - T1055: Process Injection - T1078: Valid Accounts - T1098: Account Manipulation ### 7. Hiding (4) - T1036: Masquerading - T1055: Process Injection - T1070: Indicator Removal - T1078: Valid Accounts ### 8. Disabling defences (1) - T1685: Disable or Modify Tools ### 9. Stealing passwords (2) - T1003: OS Credential Dumping - T1056: Input Capture ### 10. Looking around (4) - T1049: System Network Connections Discovery - T1057: Process Discovery - T1083: File and Directory Discovery - T1654: Log Enumeration ### 11. Spreading (1) - T1021: Remote Services ### 12. Gathering data (3) - T1056: Input Capture - T1074: Data Staged - T1560: Archive Collected Data ### 13. Keeping contact (0) - None linked in public reporting. ### 14. Taking data out (0) - None linked in public reporting. ### 15. Causing damage (0) - None linked in public reporting. ## Public reports about APT5 - https://www.fireeye.com/current-threats/apt-groups.html - https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-southeast-asia-threat-landscape.pdf - https://www.secureworks.com/research/threat-profiles/bronze-fleetwood - https://www.mandiant.com/resources/insights/apt-groups - https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi - http://internal-www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html ## Frequently asked questions ### Who is APT5? APT5 is a threat group. Public reporting links it to 21 attack techniques. ### How does APT5 attack? Public reporting links APT5 to 21 attack techniques. Most of them are about staying in, taking control and hiding. ### How do I know if APT5 is a risk to my business? Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you. ## Check whether it matters to your business A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each. - Start free: https://www.edgeprotect.io/register - Book a demo: https://www.edgeprotect.io/contact