Tonto Team
Tonto Team is classified as state-sponsored.
- Malware families
- 7
- Suspected state sponsor
- China
- Also known as
- 10
Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malware, including the Bisonal RAT and ShadowPad. They employ spear-phishing emails with malicious attachments as their preferred method of distribution.
The group is suspected of operating with the support of China.
The group is associated with 7 malware families.
Also known as: CactusPete, KARMA PANDA, BRONZE HUNTLEY, COPPER, Red Beifang, G0131, PLA Unit 65017, Earth Akhlut, TAG-74, LONE CASTLE
The group is associated with 7 malware families.
Malware families
- 8.t Dropper
- CALMTHORN
- Dexbia
- Korlia
- QUICKMUTE
- ShadowPad
- TypeHash
Published reports on this actor:
- https://arstechnica.com/information-technology/2017/04/researchers-claim-china-trying-to-hack-south-korea-missile-defense-efforts/
- https://docs.huihoo.com/rsaconference/usa-2014/anf-t07b-the-art-of-attribution-identifying-and-pursuing-your-cyber-adversaries-final.pdf
- https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.