Sciextor

APT 20

APT 20 is a threat group that has been attributed to China’s Ministry of State Security (MSS).

They have been active since at least 2009, targeting government, military, and commercial organizations in Europe, Asia, and North America.

History

• Compromising the networks of several managed service providers (MSPs) and using their access to target their clients.
• Exploiting a zero-day vulnerability in the JBoss enterprise application platform to install web shells and backdoors on vulnerable servers.
• Using a custom malware called QuasarRAT to remotely control infected machines and steal sensitive data.
• Leveraging stolen certificates and digitally signed malware to evade detection and bypass security controls.

Aliases

• JUMPING SPIDER
• Violin Panda
• BRONZE PRESIDENT