{
  "id": "apt30",
  "name": "APT30",
  "aliases": [],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Suspected association with the Chinese government",
      "src": [
        "mitre-g0013"
      ],
      "conf": "medium"
    },
    {
      "k": "attack_id",
      "v": "G0013",
      "src": [
        "mitre-g0013"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 2,
      "src": [
        "mitre-g0013"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BACKSPACE, FLASHFLOOD, NETEAGLE, SHIPSHAPE, SPACESHIP",
      "src": [
        "mitre-g0013"
      ],
      "conf": "high",
      "note": "5 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0013)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/apt30.html",
  "sources": {
    "mitre-g0013": {
      "title": "APT30, Group G0013",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0013/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}