{
  "id": "admin-338",
  "name": "admin@338",
  "aliases": [],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors.",
  "specs": [
    {
      "k": "sponsor",
      "v": "China-based",
      "src": [
        "mitre-g0018"
      ],
      "conf": "medium"
    },
    {
      "k": "attack_id",
      "v": "G0018",
      "src": [
        "mitre-g0018"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors.",
      "src": [
        "mitre-g0018"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 12,
      "src": [
        "mitre-g0018"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BUBBLEWRAP, ipconfig, LOWBALL, Net, netstat, PoisonIvy, Systeminfo",
      "src": [
        "mitre-g0018"
      ],
      "conf": "high",
      "note": "7 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0018)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/admin-338.html",
  "sources": {
    "mitre-g0018": {
      "title": "admin@338, Group G0018",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0018/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}