apt
APT groups is a generic umbrella term for advanced persistent threat actors rather than a single named threat actor. The provided content describes APT activity in Q3 2025 as being dominated by zero-day vulnerabilities that were initially uncovered during investigations of isolated incidents, followed by broader exploitation after public disclosure. Reported exploitation and post-exploitation activity associated with APT attacks included use of common C2 frameworks such as Metasploit, Sliver, Mythic, Empire, and rapid adoption of Adaptix C2. The content also states that exploits interacting with C2 agents in APT attacks included CVE-2020-1472 (ZeroLogon), CVE-2021-34527 (PrintNightmare), and WinRAR vulnerabilities CVE-2025-6218 and CVE-2025-8088. The report highlights “ToolShell” Microsoft SharePoint vulnerabilities (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) enabling authentication bypass and full server compromise, and references CVE-2025-41244 in VMware Aria Operations and VMware Tools as a privilege-escalation issue that researchers claimed was used in real-world attacks in 2024. Separately, the content states that nation-state attacks by APT groups have been documented using NTP for passive reconnaissance inside government and critical infrastructure networks, including silent enumeration of high-value hosts by querying NTP peers before spear-phishing campaigns. Aliases present in the content are: apt, apt_actors, apt_group, apt_groups, and apts.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated vulnerabilities
4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.
...active exploitation of a newly identified vulnerability (CVE-2021-40539) in ManageEngine ADSelfService Plus... rated critical... an authentication bypass vulnerability affecting ... REST API URLs that could enable remote code execution... reports of malicious cyber actors using exploits against CVE-2021-40539 to gain access...
The bug that's already being exploited in the wild, tracked as CVE-2022-37969, is in Windows' Common Log File System... Exploit code for this privilege-escalation flaw is also publicly available.
The first flaw added to the KEV catalog targets Langflow... Tracked as CVE-2025-34291 and carrying a critical CVSS score of 9.4, the vulnerability affects all installations up to and including version 1.6.9... When an authenticated Langflow user is tricked into visiting a malicious webpage... the attacker takes over the user session and leverages Langflow’s built-in visual code execution suite to gain remote code execution (RCE) natively over the host runtime.
The second newly listed exploit hits traditional network defense layers, targeting a directory traversal vulnerability within Trend Micro Apex One. Tracked as CVE-2026-34926 (CVSS 6.7), the flaw is strictly isolated to on-premises installations of the Apex One server software... a pre-authenticated local attacker can use directory traversal primitives... to bypass filesystem restrictions and programmatically write data into highly restricted internal directories.
Observables
300 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Advanced Persistent Threat (APT) groups in Q3 2025 are actively exploiting both new zero-day and long-standing vulnerabilities to gain initial access to systems, launch C2 frameworks, and move laterally within victim networks. They are leveraging a mix of recently discovered and older vulnerabilities, with a focus on those that enable remote code execution and privilege escalation.
APT groups have used NTP abuse for passive reconnaissance, silently enumerating high-value hosts and mapping internal network structures prior to launching targeted attacks such as spear-phishing campaigns.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.