Tonto Team
Tonto Team is a Chinese-linked cyber-espionage threat actor also known as CactusPete, Karma Panda, BRONZE HUNTLEY, COPPER TYPHOON, Earth Akhlut, SharpR, and TAG-74. The content states that CactusPete is a Chinese-speaking cyber-espionage group and that researchers connected Tonto Team to China. The group has been publicly known since at least 2013. According to the content, Tonto Team has targeted organizations in Eastern Europe, including compromising the email servers of a procurement company and a consulting company specialized in software development and cybersecurity. Separate reporting in the content links ShadowPad activity associated with BRONZE HUNTLEY to targets in South Korea, Russia, Japan, and Mongolia. The group has delivered payloads via spearphishing attachments and relied on user interaction to open malicious RTF documents. The content also states that Tonto Team has used PowerShell to download additional payloads, abused a legitimate and signed Microsoft executable to launch a malicious DLL, and exploited CVE-2019-0803 and MS16-032 for privilege escalation. Bisonal is described as a remote access trojan that is part of the Tonto Team arsenal. The content also links Tonto Team/CactusPete to ShadowPad-related activity, including references to a strong connection between recent ShadowPad samples and the CactusPete threat actor. ShadowPad is noted in the content as malware shared among multiple Chinese threat actors, including CactusPete/Tonto Team.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇰🇷 South Korea
- 🇷🇺 Russia
- 🇯🇵 Japan
- 🇲🇳 Mongolia
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
Associated vulnerabilities
13 CVEs this actor has used in observed campaigns. 13 of them exploited in the wild.
In 2019, the actor behind Bisonal used a new way to deploy the machine on the target's systems. They sent a malicious RTF document to the targets with an exploit targeting the CVE-2018-0798 (Microsoft's Equation Editor vulnerability). The purpose of the shellcode was not to execute the malware (as it is usual) but simply to drop it in the %APPDATA%\microsoft\word\startup\ repository with the .wll extension.
May 2018: a new wave of targeted attacks abusing CVE-2018-8174 (this exploit has been associated with the DarkHotel APT group, as described on Securelist), with diplomatic, defense, manufacturing, military and government targets in Asia and Eastern Europe;
...has exploited Office vulnerabilities such as CVE-2017-11882...
...has exploited Microsoft Office vulnerabilities... CVE-2018-0802.
Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.
8 more CVEs tied to this actor tracked in Mallory.
Observables
81 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed in the detection annotations as a threat actor associated with exploitation for privilege escalation.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Referenced as a threat actor associated with exploitation for privilege escalation, specifically the use of Windows Potato-family privilege escalation tools.
Listed in the detection annotations as a threat actor associated with MSI-based privilege escalation and Msiexec abuse techniques.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.