Threat group.View on attack.mitre.org
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).
| Technique | Procedure example |
|---|---|
| T1003 OS Credential Dumping |
Tonto Team has used a variety of credential dumping tools. |
| T1056.001 Keylogging |
Tonto Team has used keylogging tools in their operations. |
| T1059.001 PowerShell |
Tonto Team has used PowerShell to download additional payloads. |
| T1059.006 Python |
Tonto Team has used Python-based tools for execution. |
| T1068 Exploitation for Privilege Escalation |
Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges. |
| T1069.001 Local Groups |
Tonto Team has used the |
| T1090.002 External Proxy |
Tonto Team has routed their traffic through an external server in order to obfuscate their location. |
| T1105 Ingress Tool Transfer |
Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader. |
| T1135 Network Share Discovery |
Tonto Team has used tools such as NBTscan to enumerate network shares. |
| T1203 Exploitation for Client Execution |
Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads. |
| T1204.002 Malicious File |
Tonto Team has relied on user interaction to open their malicious RTF documents. |
| T1210 Exploitation of Remote Services |
Tonto Team has used EternalBlue exploits for lateral movement. |
| T1505.003 Web Shell |
Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server. |
| T1566.001 Spearphishing Attachment |
Tonto Team has delivered payloads via spearphishing attachments. |
| T1574.001 DLL |
Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
