AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
APT5
Aliases: APT5, BRONZE FLEETWOOD, Keyhole Panda, MANGANESE, Mulberry Typhoon, UNC2630
[APT5](https://attack.mitre.org/groups/G1023) is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. [APT5](https://attack.mitre.org/groups/G1023) has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.(Citation: NSA APT5 Citrix Threat Hunting December 2022)(Citation: Microsoft East Asia Threats September 2023)(Citation: Mandiant Pulse Secure Zero-Day April 2021)(Citation: Mandiant Pulse Secure Update May 2021)(Citation: FireEye Southeast Asia Threat Landscape March 2015)(Citation: Mandiant Advanced Persistent Threats)
Open interactive actor investigation
ATT&CK techniques
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tasklist tool reference — Explicit actor uses software relationship in pinned ATT&CK
- netstat tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PcShare tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.002 Security Account Manager simulation — Exact active technique ID
- T1003.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.004 SSH simulation — Exact active technique ID
- T1021.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.003 Cron simulation — Exact active technique ID
- T1053.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055 Process Injection simulation — Exact active technique ID
- T1055 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070 Indicator Removal simulation — Exact active technique ID
- T1070 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.003 Clear Command History simulation — Exact active technique ID
- T1070.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.006 Timestomp simulation — Exact active technique ID
- T1070.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.002 Domain Accounts simulation — Exact active technique ID
- T1078.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098.007 Additional Local or Domain Groups simulation — Exact active technique ID
- T1098.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1136.001 Local Account simulation — Exact active technique ID
- T1136.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1554 Compromise Host Software Binary simulation — Exact active technique ID
- T1554 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.005 Botnet simulation — Exact active technique ID
- T1583.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1654 Log Enumeration simulation — Exact active technique ID
- T1654 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-nameShared responsibility, governance, and service ownership
Cloud Security · topic-matchOrganizations, landing zones, policy, inventory, and cost guardrails
Cloud Security · topic-match