APT17
APT17 is a China-linked threat actor, assessed in the provided content as MSS-linked and active since at least 2009. The content links APT17 to high-profile campaigns such as Operation Aurora and identifies aliases including APT17, ATG3, Aurora Panda, Blackfly, Bronze Export, Bronze University, DeputyDog / Deputy Dog, Hidden Lynx, Red Typhoon, TA415, Tailgater, TG-3279, and TG-8153. The content also notes reporting that Blackfly and Grayfly are used to distinguish cybercrime and cyberespionage activity respectively, and that ShadowPad is associated with APT41-nexus groups such as Blackfly, Grayfly, and Redfly. Based on the provided material, APT17 has been associated with spear-phishing activity, including reporting on TA415-attributed campaigns targeting U.S. government, think tank, and academic organizations using U.S.-China economic-themed lures. The content also states that APT17 created Microsoft TechNet profile pages used as command-and-control infrastructure. The content associates APT17 with BLACKCOFFEE malware, describing it as a hallmark of APT17, and states that ZoxRPC evolved into ZoxPNG, also known as BLACKCOFFEE, which MITRE ATT&CK attributed to APT17 and APT41. The material further identifies Zeng Xiaoyong as a central figure or member of APT17 and links him specifically to BLACKCOFFEE and to development of an MS08-067 exploit associated with ZoxPRC. The content highlights substantial overlap between APT17 and APT41 in malware, developer relationships, and social connections, but presents this as overlap and interconnectedness rather than a definitive merger. It also notes that some reporting previously associated Voldemort activity with TA415 or APT41, while other analysis assessed a distinct cluster. The content additionally states that Bronze Export has targeted the entertainment and video game industries since at least 2009, with moderate-confidence assessment that it is based in the People’s Republic of China and focused on collecting video game source code for cracking, cheating tools, or competing products.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Academia & Research
- Software & Services
- Materials
- Insurance
- Capital Goods
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
48 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
17 malware families attributed to this actor across reporting.
12 additional families tracked in Mallory.
Observables
44 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as the broader China-nexus umbrella under which Silver Dragon likely operates.
Referenced as the broader umbrella under which Silver Dragon is believed to operate; associated here with China-linked cyberespionage activity targeting government/public sector.
Referenced as an established Chinese espionage ecosystem that Silver Dragon’s activity overlaps with; no direct APT41 operation details are provided beyond the linkage/overlap claim.
China-linked espionage and financially motivated operations: collection from telecom, healthcare, semiconductor manufacturing, and machine learning organizations, plus virtual currency theft.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.