APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | G0013 |
| OSINT | ISTHMUS CASTLE |
Sectors: Government
Victim countries: United States, South Korea, Saudi Arabia, Thailand, Vietnam, Malaysia, India
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names APT30, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT30. Each row shows why it was linked and where it came from.
| Type | Indicator | Linked by | Seen | Source |
|---|---|---|---|---|
| hostname | www.newpresses.com | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| hostname | www.km153.com | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| hostname | www.appsecnic.com | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-SHA256 | 19d8bd80d362aa43623081b1ea516da6f500b917ba484c8c85b7919764af5bc0 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-SHA256 | 21477cb4ea18c8657cbcf076701808f02fca27f391a5a1ac9ebb61d83033cf71 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-SHA256 | b16e1f2adb6e83e787ac7dbed2f09f1fd09f0ac08bf63484056746ebff4dda8b | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-SHA256 | a0d3450eebbe0021aaa109fe1bcf3d8f1786c112caf26d2e344a5701e314497a | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| URL | http://www.techmicrost.com/infos/p | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| URL | http://www.kabadefender.com/plugins/r.exe | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| URL | http://www.gordeneyes.com/photo/ | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| URL | http://www.gordeneyes.com/infos/p | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| URL | http://www.kabadefender.com/clntsignin.php | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| URL | http://www.kabadefender.com/clntcmd.php | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| hostname | www.gordeneyes.com | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| hostname | www.techmicrost.com | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| hostname | www.kabadefender.com | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-MD5 | f4f8f64fd66a62fc456da00dd25def0d | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-MD5 | 95fde34187552a2b0b7e3888bfbff802 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-MD5 | 9cb8a0cb778906c046734fbe67778c61 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-MD5 | ed09b0dba74bf68ec381031e2faf4448 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-MD5 | c9b1c8b51234265983cf8427592b0a68 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-MD5 | 101bda268bf8277d84b79fe52e25fee4 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-MD5 | d9c42dacfae73996ccdab58e429548c0 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-MD5 | 634e79070ba21e1e8f08aba995c98112 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-MD5 | 56725556d1ac8a58525ae91b6b02cf2c | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-SHA1 | 248e2c6821d14c77d497858846bd490a76af4bb3 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-SHA1 | 9d7787dc9c204a203356401032095a9d69f21492 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-SHA1 | ed79d765c002e767ba5ed6cf8b878671a0ff25c3 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| FileHash-SHA1 | e211cad9f59bd8ab0a916dd27a7eb9501eee170c | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| domain | km153.com | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| domain | newpresses.com | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| domain | appsecnic.com | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| URL | http://103.233.10.152:4433 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| URL | http://172.247.197.189:443 | OTX pulse "The eagle eye is back: old and new backdoors from APT30" | 2020-06-22 | AlienVault OTX |
| domain | aseanm.com | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.iapfreecenter.com/Lnk1z/hostlist.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.cbkjdxf.com/04-1/04-1.htm | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.autoapec.com/yzstmfa/update.xml | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.newpresses.com/some/edih.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.autoapec.com/yzstmfa/pic2.bmp | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.bigfixtools.com/ForZRLnk3z/hostlist.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.appsecnic.com/Lnk1z/bak.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.km153.com/some/edih.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.bigfixtools.com/ForZRLnk3z | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.creammemory.com/update1/pic2.bmp | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.km-nyc.com/http/nur.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.newpresses.com/http/nur.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.appsecnic.com/http/nur.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.autoapec.com/yzstmfa/pic4.bmp | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.bluesixnine.com/http/nur.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.lisword.com/HM/Update.htm | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.autoapec.com/yzstmfa/pic1.bmp | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.bluesixnine.com/some/edih.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.iapfreecenter.com/Lnk1z | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.km153.com/http/nur.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.appsecnic.com/some/edih.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.km-nyc.com/some/edih.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.km153.com/ForZRLnk3z/bak.txt | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| URL | http://www.autoapec.com/yzstmfa/updateapp.xml | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| hostname | www.creammemory.com | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| hostname | www.cbkjdxf.com | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| hostname | www.bluesixnine.com | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| hostname | www.autoapec.com | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| hostname | www.km-nyc.com | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| hostname | www.iapfreecenter.com | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| hostname | www.lisword.com | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| hostname | www.bigfixtools.com | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | 5d4f2871fd1818527ebd65b0ff930a77 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | c90f798ccfbedb4bbe6c4568e0f05b68 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | acb2ba25ef225d820ac8a5923b746cb8 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | d2661543c3c456f5fafdd97e31aaff17 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | 7d775a39ecd517cee4369c672e0e4da7 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | 11876eaadeac34527c28f4ddfadd1e8d | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | 8a88f8803e8db8baee537a175960cdbe | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | bf8616bbed6d804a3dea09b230c2ab0c | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | f18be055fae2490221c926e2ad55ab11 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | 6ee35da59f92f71e757d4d5b964ecf00 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | 3feef9a0206308ee299a05329095952a | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | af504e86416c5f643e96f6e5e69566f0 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | b2138a57f723326eda5a26d2dec56851 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | 38a61bbc26af6492fc1957ac9b05e435 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | 8c713117af4ca6bbd69292a78069e75b | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | b249bcf741e076f11b6c9553f6104f16 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-MD5 | f054c0f8c5b4c2a5eb30a16ebe09d8d0 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| YARA | 78b6f93e4d09591725f872b61beb296b7bc6bb47 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
| FileHash-SHA256 | 6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99 | OTX pulse "APT30" | 2017-08-24 | AlienVault OTX |
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.