D
CyberChina

APT12

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: IXESHE, DynCalc, Numbered Panda, DNSCALC

CyberCHN
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeSuspected state-linked cyber threat group
Alternative designationsIXESHE, DynCalc, Numbered Panda, DNSCALC
ProliferationOrigin country only
MITRE ATT&CK IDG0005High[1]
Capabilities
ATT&CK techniques used5ATT&CK v20.1High[1]
Malware and toolsHTRAN, Ixeshe, RIPTIDE3 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorAttributed to ChinaMed[1]
TargetsThe group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.Med[1]
Notes
APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
China
Sources
  1. APT12, Group G0005, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0005)