FireEye described APT17 in a 2015 report as: 'APT17, also known as DeputyDog, is a China based threat group that FireEye Intelligence has observed conducting network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations.'
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Group 8 |
| OSINT | AURORA PANDA |
| OSINT | Hidden Lynx |
| OSINT | Tailgater Team |
| OSINT | Dogfish |
| OSINT | BRONZE KEYSTONE |
| OSINT | G0025 |
| OSINT | Group 72 |
| OSINT | G0001 |
| OSINT | Axiom |
| OSINT | HELIUM |
| OSINT | Heart Typhoon |
| OSINT | Deputy Dog |
Sectors: Government, Private sector, Civil society, Defense, Intelligence, Technology, Mining, Government, Administration, Justice
Victim countries: United States, Netherlands, Italy, Japan, United Kingdom, Belgium, Russia, Indonesia, Germany, Switzerland, China
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names APT17, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT17. Each row shows why it was linked and where it came from.
| Type | Indicator | Linked by | Seen | Source |
|---|---|---|---|---|
| hostname | www.accounts-googlc.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | wscsvc.net | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | secbkav.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | teledynegroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | usdagroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | yqdac.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | thyssenkrupp-marinesystems.org | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | 02966d799a0c22d81e5878aa9b2389da4af892d0481409b07c35e06475d95a97 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | ced7ca9625543d3d3d09f70223cc19f0d99e21792854452df5ba84b3a59d17b8 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | accounts-googlc.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | pir0i.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | yahxi123.cn | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | thyssemkrupp.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | dpc0p.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | 0ef4c20549cda02c574c6fd6462481c675f39e56fedbd869943cff7931fc5dc5 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | 57976133193b732bb5602345d6aa7ff83555a365f415212dbefae016fc3b57aa | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | fd9e4b112b950d8c8221bf344e37a9c4a7a9159f42a19e75b0b440649e99ef79 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | ebc248332897cadabf4687442acee70b20430b91a4f00b0b9fb855bddade6f28 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | 7c54e1a5dbabf54d0cd43028218d38e5f83158f3f5235599723907b40389ac5d | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | d24f072918a612a5c84d05b37d91a5a109a40e1d53aa2403c543d28fcb8eed93 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | 9d93f31b77f1cc350d0f5660d1ce81ea39aceb0fd2ff07a912375076ca0eada3 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | ff603281086b15559e17d368a93a9effe284442495b2874e82c0655bf8f7f1e9 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | 2306576eddd49513034530f4bd525d4a6e5d75912f904b911e820e35270f8249 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | 70e6533deeb7dde53529b9ab4f1d9f3e823fd0a61798ed27a1c9f4bbebb816f3 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA256 | 208756593166db40a35bdb37c5d27915a41055e621c8dc5e6972f4a2c3eadd3a | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://www.wscsvc.net/ | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://backup.wscsvc.net/007cf8d976ee0862487c78ec071ce2e7 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://backup.wscsvc.net/ | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://backup.wscsvc.net/d1a326be4a422e92308bbcf8ea154f6d | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://exchange.wscsvc.net/fb13c3cf930f5714f9081a49844209e7 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://exchange.wscsvc.net/ | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://accounts-googlc.com/ | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://backup.wscsvc.net/fb13c3cf930f5714f9081a49844209e7 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://backup.wscsvc.net/4ad40fc46bd1dd7cf97cf0568c86956f | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://www.wscsvc.net:8080/logon.aspx?Id=s07PD1cd2UmfOBm7p8YaFg== | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://exchange.wscsvc.net/d1a326be4a422e92308bbcf8ea154f6d | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://access.wscsvc.net/ | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://exchange.wscsvc.net/0777ae914c11045d00159744ccdc8109 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | www.secbkav.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | backup.wscsvc.net | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | www.usdagroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | exchange.wscsvc.net | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | ns1.wscsvc.net | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | www.d0m1c7devn.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | www.wscsvc.net | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | usda.teledynegroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | ftp.teledynegroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | whoi.usdagroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | rsc-to.teledynegroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | godie.usdagroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | www.teledynegroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | shop.thyssenkrupp-marinesystems.org | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | 1si2.yqdac.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | back.teledynegroup.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | access.wscsvc.net | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | www.thyssenkrupp-marinesystems.org | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-MD5 | d1a326be4a422e92308bbcf8ea154f6d | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-MD5 | 4ad40fc46bd1dd7cf97cf0568c86956f | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-MD5 | d901a5737d7a0c37aa42798cb523150f | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-MD5 | fb13c3cf930f5714f9081a49844209e7 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-MD5 | 007cf8d976ee0862487c78ec071ce2e7 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-MD5 | 0777ae914c11045d00159744ccdc8109 | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| FileHash-SHA1 | 14d4ce4666ee1a0dc0ed341c9007934d3aba401f | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| emm@ph4nt0m.org | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX | |
| hostname | matrix.bcvziy.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | ibackdoor.net | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | bcvziy.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| hostname | www.missll.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| URL | http://www.missll.com/file.exe | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
| domain | missll.com | OTX pulse "APT17 Identified" | 2023-12-06 | AlienVault OTX |
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.