{
  "id": "apt5",
  "name": "APT5",
  "aliases": [
    "Mulberry Typhoon",
    "MANGANESE",
    "BRONZE FLEETWOOD",
    "Keyhole Panda",
    "UNC2630"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.",
  "specs": [
    {
      "k": "sponsor",
      "v": "China-based",
      "src": [
        "mitre-g1023"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2007,
      "src": [
        "mitre-g1023"
      ],
      "conf": "medium",
      "note": "At least 2007"
    },
    {
      "k": "attack_id",
      "v": "G1023",
      "src": [
        "mitre-g1023"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia.",
      "src": [
        "mitre-g1023"
      ],
      "conf": "medium"
    },
    {
      "k": "campaigns",
      "v": "SPACEHOP Activity (C0052, 2019–2024)",
      "src": [
        "mitre-g1023"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 29,
      "src": [
        "mitre-g1023"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "gh0st RAT, Mimikatz, Net, netstat, PACEMAKER, PcShare, PoisonIvy, PULSECHECK, RAPIDPULSE, Skeleton Key, SLIGHTPULSE, SLOWPULSE, Tasklist",
      "src": [
        "mitre-g1023"
      ],
      "conf": "high",
      "note": "13 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1023)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/apt5.html",
  "sources": {
    "mitre-g1023": {
      "title": "APT5, Group G1023",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1023/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}