Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malware, including the Bisonal RAT and ShadowPad. They employ spear-phishing emails with malicious attachments as their preferred method of distribution.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | CactusPete |
| OSINT | KARMA PANDA |
| OSINT | BRONZE HUNTLEY |
| OSINT | COPPER |
| OSINT | Red Beifang |
| OSINT | G0131 |
| OSINT | PLA Unit 65017 |
| OSINT | Earth Akhlut |
| OSINT | TAG-74 |
| OSINT | LONE CASTLE |
Sectors: Military, Government, Private sector
Victim countries: Eastern Europe, Japan, South Korea, Taiwan, United States
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Tonto Team, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Tonto Team. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.