{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "apt40",
    "slug": "apt40",
    "name": "APT40",
    "shortName": "APT40",
    "country": "China",
    "countryCode": "CN",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2009",
    "prominence": 85,
    "mitreGroupId": "G0065",
    "malpediaSlug": "apt40",
    "tagline": "MSS Hainan bureau running maritime and naval technology collection — and among the fastest actors at weaponising new vulnerabilities.",
    "bio": "APT40 conducts maritime-focused collection aligned with China's naval modernisation and South China Sea claims. Its targeting is unusually coherent: naval engineering firms, universities conducting undersea and marine research, port and shipping operators, and the defence contractors supplying submarine and autonomous vehicle technology.\n\nThe group's operational signature is speed. An August 2024 advisory led by the Australian Signals Directorate and co-sealed by eight countries highlighted its ability to weaponise proof-of-concept exploits for new vulnerabilities within hours of public release — repeatedly reaching targets faster than those targets could patch. It complements this with persistent scanning for end-of-life and unmanaged internet-facing devices, and heavy use of compromised small-office routers as operational relays.\n\nIn July 2021 the U.S. Department of Justice indicted four individuals: three officers of the Hainan State Security Department and one contractor, operating through the front company Hainan Xiandun Technology Development Co. The indictment describes a front company that ran genuine job advertisements and even hired translators to process stolen material.",
    "attribution": {
      "sponsor": "China",
      "service": "Ministry of State Security (MSS) — Hainan State Security Department",
      "unit": "Hainan Xiandun Technology Development Co. (front company)",
      "confidence": "confirmed",
      "summary": "Four individuals were indicted by the U.S. Department of Justice in July 2021: HSSD officers Ding Xiaoyang, Cheng Qingmin, and Zhu Yunmin, and contractor Wu Shurong. The indictment establishes Hainan Xiandun Technology Development Co. as a front for the Hainan State Security Department, a provincial arm of the MSS, and describes a 2011–2018 campaign against targets in at least a dozen countries. The attribution was issued alongside a coordinated statement from the EU, UK, NATO, and other allies.",
      "sources": [
        {
          "org": "U.S. Department of Justice",
          "title": "Four Chinese Nationals Working with the Ministry of State Security Charged with Global Computer Intrusion Campaign",
          "url": "https://www.justice.gov/opa/pr/four-chinese-nationals-working-ministry-state-security-charged-global-computer-intrusion",
          "date": "2021-07-19"
        },
        {
          "org": "ASD / CISA / NSA / FBI and international partners",
          "title": "APT40 Advisory: PRC MSS tradecraft in action (AA24-190A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a",
          "date": "2024-07-08"
        }
      ]
    },
    "motivations": [
      "espionage",
      "ip-theft"
    ],
    "targetSectors": [
      "Maritime",
      "Defense",
      "Government",
      "Education",
      "Aerospace",
      "Technology",
      "Healthcare",
      "Manufacturing",
      "Transportation",
      "Energy"
    ],
    "targetCountries": [
      "Australia",
      "United States",
      "United Kingdom",
      "Cambodia",
      "Malaysia",
      "Philippines",
      "Norway",
      "Germany",
      "Saudi Arabia"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "APT40",
        "url": "https://attack.mitre.org/groups/G0065/",
        "correlation": "exact"
      },
      {
        "org": "microsoft",
        "name": "Gingham Typhoon",
        "correlation": "exact",
        "note": "Formerly GADOLINIUM"
      },
      {
        "org": "microsoft",
        "name": "GADOLINIUM",
        "correlation": "exact",
        "note": "Retired designator"
      },
      {
        "org": "crowdstrike",
        "name": "Kryptonite Panda",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "APT40",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "TEMP.Periscope",
        "correlation": "exact",
        "note": "Earlier Mandiant designator"
      },
      {
        "org": "mandiant",
        "name": "TEMP.Jumper",
        "correlation": "exact",
        "note": "Earlier Mandiant designator"
      },
      {
        "org": "proofpoint",
        "name": "Leviathan",
        "correlation": "exact"
      },
      {
        "org": "secureworks",
        "name": "BRONZE MOHAWK",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "APT40 / Hainan State Security Department",
        "correlation": "exact"
      },
      {
        "org": "recordedfuture",
        "name": "ISLANDDREAMS",
        "correlation": "exact"
      },
      {
        "org": "kaspersky",
        "name": "MUDCARP",
        "correlation": "exact"
      }
    ],
    "tools": [
      {
        "name": "Derusbi",
        "type": "backdoor",
        "custom": true,
        "description": "Long-lived implant family with Windows and Linux variants, shared across several Chinese groups.",
        "malpediaSlug": "win.derusbi"
      },
      {
        "name": "MURKYTOP",
        "type": "utility",
        "custom": true,
        "description": "Command-line reconnaissance tool for host and network enumeration inside victim environments."
      },
      {
        "name": "BADFLICK",
        "type": "backdoor",
        "custom": true,
        "description": "Backdoor delivered via web-based exploitation, supporting file transfer and shell access.",
        "malpediaSlug": "win.badflick"
      },
      {
        "name": "PHOTO / Derusbi variants",
        "type": "backdoor",
        "custom": true,
        "description": "Modular backdoors used for durable access to engineering and research networks."
      },
      {
        "name": "Compromised SOHO routers",
        "type": "utility",
        "custom": false,
        "description": "End-of-life and unpatched small-office devices used as operational relay infrastructure in victim geographies."
      },
      {
        "name": "Web shells",
        "type": "utility",
        "custom": false,
        "description": "Deployed rapidly to internet-facing applications following exploitation of newly disclosed vulnerabilities."
      }
    ],
    "techniques": [
      {
        "tCode": "T1190",
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "note": "Weaponises public proof-of-concept exploits within hours of release"
      },
      {
        "tCode": "T1595.002",
        "name": "Active Scanning: Vulnerability Scanning",
        "tactic": "Reconnaissance",
        "note": "Continuous scanning of target networks for newly exposed or end-of-life services"
      },
      {
        "tCode": "T1566.002",
        "name": "Phishing: Spearphishing Link",
        "tactic": "Initial Access"
      },
      {
        "tCode": "T1584.005",
        "name": "Compromise Infrastructure: Botnet",
        "tactic": "Resource Development",
        "note": "SOHO router relays to blend C2 with local traffic"
      },
      {
        "tCode": "T1505.003",
        "name": "Server Software Component: Web Shell",
        "tactic": "Persistence"
      },
      {
        "tCode": "T1003.001",
        "name": "OS Credential Dumping: LSASS Memory",
        "tactic": "Credential Access"
      },
      {
        "tCode": "T1078",
        "name": "Valid Accounts",
        "tactic": "Persistence"
      },
      {
        "tCode": "T1213",
        "name": "Data from Information Repositories",
        "tactic": "Collection",
        "note": "Research repositories and engineering document stores"
      },
      {
        "tCode": "T1074.001",
        "name": "Data Staged: Local Data Staging",
        "tactic": "Collection"
      },
      {
        "tCode": "T1048.003",
        "name": "Exfiltration Over Unencrypted Non-C2 Protocol",
        "tactic": "Exfiltration"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2021-31207",
        "firstExploited": "2021-08-01",
        "usage": "ProxyShell component exploited against Exchange servers for initial access to targeted organisations.",
        "source": {
          "org": "ASD / CISA and partners",
          "title": "APT40 Advisory (AA24-190A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a",
          "date": "2024-07-08"
        }
      },
      {
        "cveId": "CVE-2021-26855",
        "firstExploited": "2021-03-01",
        "usage": "ProxyLogon exploited following public disclosure, alongside other Chinese groups.",
        "source": {
          "org": "ASD / CISA and partners",
          "title": "APT40 Advisory (AA24-190A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a",
          "date": "2024-07-08"
        }
      },
      {
        "cveId": "CVE-2019-19781",
        "firstExploited": "2020-01-01",
        "usage": "Citrix ADC traversal exploited rapidly after disclosure for perimeter access.",
        "source": {
          "org": "ASD / CISA and partners",
          "title": "APT40 Advisory (AA24-190A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a",
          "date": "2024-07-08"
        }
      },
      {
        "cveId": "CVE-2022-26134",
        "firstExploited": "2022-06-05",
        "usage": "Atlassian Confluence OGNL injection weaponised within days of disclosure against research and government targets.",
        "source": {
          "org": "ASD / CISA and partners",
          "title": "APT40 Advisory (AA24-190A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a",
          "date": "2024-07-08"
        }
      },
      {
        "cveId": "CVE-2021-44228",
        "firstExploited": "2021-12-01",
        "usage": "Log4Shell exploited across internet-facing Java applications immediately following disclosure.",
        "source": {
          "org": "ASD / CISA and partners",
          "title": "APT40 Advisory (AA24-190A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a",
          "date": "2024-07-08"
        }
      },
      {
        "cveId": "CVE-2017-11882",
        "firstExploited": "2018-01-01",
        "usage": "Equation Editor exploit in maritime- and defence-themed lure documents.",
        "source": {
          "org": "Proofpoint",
          "title": "Leviathan: Espionage actor spearphishes maritime and defense targets",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets",
          "date": "2017-10-16"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "apt41",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both MSS-aligned contractor operations with distinct regional taskings."
      },
      {
        "relatedActorId": "volt-typhoon",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Shared preference for compromised SOHO routers as in-country operational relays."
      },
      {
        "relatedActorId": "apt10",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both provincial MSS bureau operations run through named front companies."
      }
    ],
    "reports": [
      {
        "org": "ASD / CISA / NSA and partners",
        "title": "AA24-190A: APT40 Advisory — PRC MSS tradecraft in action",
        "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a",
        "date": "2024-07-08"
      },
      {
        "org": "U.S. Department of Justice",
        "title": "Indictment: Four Chinese Nationals — Hainan State Security Department",
        "url": "https://www.justice.gov/opa/press-release/file/1412916/download",
        "date": "2021-07-19"
      },
      {
        "org": "Mandiant / FireEye",
        "title": "APT40: Examining a China-Nexus Espionage Actor",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt40-examining-a-china-nexus-espionage-actor",
        "date": "2019-03-04"
      },
      {
        "org": "Intrusion Truth",
        "title": "Who is Mr Gu? — Hainan Xiandun front company analysis",
        "url": "https://intrusiontruth.wordpress.com/2020/01/09/who-is-mr-gu/",
        "date": "2020-01-09"
      }
    ],
    "campaigns": [
      {
        "id": "apt40-rapid-exploit",
        "actorId": "apt40",
        "name": "Rapid Exploitation of New Vulnerabilities",
        "date": "2020-01-01",
        "significance": "major",
        "targetSectors": [
          "Government",
          "Maritime",
          "Defense",
          "Education",
          "Healthcare"
        ],
        "targetCountries": [
          "Australia",
          "United States",
          "United Kingdom",
          "Canada",
          "New Zealand",
          "Japan"
        ],
        "cveIds": [
          "CVE-2021-31207",
          "CVE-2021-26855",
          "CVE-2019-19781",
          "CVE-2022-26134",
          "CVE-2021-44228"
        ],
        "summary": "A sustained pattern of weaponising public proof-of-concept exploits within hours of release, repeatedly reaching targets faster than they could patch. Documented in a 2024 advisory led by the Australian Signals Directorate and co-sealed by eight countries.",
        "sources": [
          {
            "org": "ASD / CISA / NSA and partners",
            "title": "AA24-190A: APT40 Advisory — PRC MSS tradecraft in action",
            "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a",
            "date": "2024-07-08"
          }
        ]
      }
    ],
    "flag": "🇨🇳",
    "profile": "/apt/apt40/"
  }
}