{
  "id": "tonto-team",
  "name": "Tonto Team",
  "aliases": [
    "Earth Akhlut",
    "BRONZE HUNTLEY",
    "CactusPete",
    "Karma Panda"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).",
  "specs": [
    {
      "k": "sponsor",
      "v": "Suspected Chinese state-sponsored",
      "src": [
        "mitre-g0131"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2009,
      "src": [
        "mitre-g0131"
      ],
      "conf": "medium",
      "note": "At least 2009"
    },
    {
      "k": "attack_id",
      "v": "G0131",
      "src": [
        "mitre-g0131"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries.",
      "src": [
        "mitre-g0131"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 15,
      "src": [
        "mitre-g0131"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Bisonal, gsecdump, LaZagne, Mimikatz, NBTscan, ShadowPad",
      "src": [
        "mitre-g0131"
      ],
      "conf": "high",
      "note": "6 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017). Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0131)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/tonto-team.html",
  "sources": {
    "mitre-g0131": {
      "title": "Tonto Team, Group G0131",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0131/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}