Who’s Behind It?
APT18, also known as Wekby, is a cyber espionage group with suspected ties to China. Their operations span a wide range of high-stakes sectors, including Aerospace and Defense, Construction and Engineering, Education, Health and Biotechnology, High Tech, Telecommunications, and Transportation. If your organization operates in any of these fields, APT18 could be targeting you.
What’s Their Mission?
While not much has been publicly disclosed about APT18, what we do know is that they’re highly adaptive and opportunistic. Their operations are carefully planned, often involving the development or adaptation of zero-day exploits. This level of preparedness indicates a group that’s always ready to strike, particularly when unexpected opportunities arise—like newly exposed vulnerabilities.
Their Arsenal
APT18 is known to use Gh0st RAT, a well-established piece of malware that allows them to take control of infected systems and exfiltrate sensitive data. But it’s not just about the tools—they’re also highly skilled at shifting resources quickly to capitalize on new opportunities, as demonstrated by their use of data from the Hacking Team leak. This ability to pivot and adapt makes them a particularly dangerous adversary.
How They Get In
APT18 is known for frequently developing or adapting zero-day exploits, which they use in highly targeted operations. Their attacks are often premeditated, with infrastructure and tools prepared well in advance. For instance, following the Hacking Team leak, APT18 quickly exploited a newly exposed vulnerability (CVE-2015-5119), showcasing their ability to move fast and efficiently when new opportunities present themselves.
Why This Matters to Us
At Hedgehog Security, we understand that APT18’s ability to adapt and exploit new vulnerabilities poses a significant threat, especially to organizations in critical sectors. Their use of zero-day exploits and readiness to act on newly exposed weaknesses make them a formidable adversary, capable of causing serious damage if left unchecked.
That’s why we’re here. With our SOC365 service, we don’t just monitor for threats—we actively hunt them down. Our deep understanding of APT18’s tactics and their opportunistic nature ensures that your organization’s defenses are always up to date and ready to repel even the most sophisticated attacks.
In the fast-paced world of cybersecurity, staying ahead of groups like APT18 requires vigilance, agility, and a proactive defense strategy. At Hedgehog Security, we’re committed to keeping the pricks on the outside, so your organization can operate securely and confidently, no matter what new threats emerge.
Other stories from our Insights blog
Your message has been received!