APT23
Attribution profile
- Type
- Nation State
- Location
- China
- Known incidents
- 1 incident
- Sources
- 2 sources
- First seen
- 2020-04-27
- Last seen
- 2020-04-27
- Updated
- 2026-10-12 12:30
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
APT23, also known as Pirate Panda, is a China‑backed advanced persistent threat group that targets government and political organisations, particularly in the South China Sea region. Its typical attack chain begins with a spear‑phishing email containing a malicious Excel attachment that drops a legitimate Windows Defender executable (utilman.exe/MsMpeng.exe) and uses DLL side‑loading to execute a malicious DLL (mpsvc.dll) sharing code with exile‑RAT and KeyBoy. The DLL establishes a reverse shell over HTTP to a command‑and‑control server after querying public DNS servers, and achieves persistence via a shortcut placed in the startup folder. A representative operation is the April 2020 campaign against Da Nang, Vietnam government employees, where a holiday‑themed lure was used to compromise a government‑run data center and communicate with the C2 domain skypechatvideo[.]online.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 2 sources.