FORENSIA

THREAT_ACTOR · G0026

APT18

Also known as: APT18, TG-0416, Dynamite Panda, Threat Group-0416

Profile

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical.

MITRE ATT&CK ↗

Techniques

12 ATT&CK techniques attributed to this actor.

T1027.013 Encrypted/Encoded FileT1053.002 AtT1059.003 Windows Command ShellT1070.004 File DeletionT1071.001 Web ProtocolsT1071.004 DNST1078 Valid AccountsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1105 Ingress Tool TransferT1133 External Remote ServicesT1547.001 Registry Run Keys / Startup Folder

Software

5 malware/tools attributed to this actor.

gh0st RATHTTPBrowserhcdLoadercmdPisloader

Related corpus activity

10,099 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to APT18.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-22653cve—852
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2016-5681cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2021-4045cve—851
cve-2020-17456cve—851
cve-2020-22658cve—852
cve-2022-47945cve—851
cve-2025-23304cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,099.