This profile separates documented observations from attribution uncertainty and defensive recommendations. Follow the linked primary records for the scope and date of each observation.
- MITRE record.
- G0073.
- Associated names.
- Codoso, C0d0so0, Codoso Team, Sunshop Group.
- Attribution.
- Chinese-based group, according to MITRE.
- Deep Panda relationship.
- Unclear in open-source information.
Who is behind APT19?
MITRE describes APT19 as a Chinese-based group and tracks it as G0073. Associated names are Codoso, C0d0so0, Codoso Team and Sunshop Group. Some analysts merge APT19 and Deep Panda, but MITRE says the open-source relationship is unclear. This article keeps them distinct. Source.
Strategic Motivation
Targeting information can help prioritize investigation, but it does not establish an operator’s employer, contractual arrangements or financial model. Assess the purpose and impact of a specific incident from its evidence.
How does APT19 attack its victims?
Use the reported behaviors below as investigation leads. A phishing message, script or shared malware component alone does not identify the actor.
Initial Access
MITRE records spearphishing attachments among the procedures attributed to APT19. Preserve suspicious messages and attachments, and assess them alongside endpoint and network evidence. Source.
Execution and Persistence
The G0073 procedures include PowerShell payload execution and malicious DLLs loaded through legitimate executables. Review execution chains and persistence changes against the original report. Source.
Credential Harvesting
Review sign-ins and privileged access after suspected phishing or malware execution. Preserve evidence of any credential misuse; do not infer a theft volume or browser-dumping method from the group label.
Command and Control
Unit42’s C0d0so0 analysis describes HTTP and port22 malware variants that collected victim information and attempted to download another DLL. The report’s analysis and observation period should remain attached to these examples. Source.
Malware and Tooling
MITRE lists Empire in the G0073 software table. Its procedures also describe HTTP and port22 malware variants. Shared software does not make every report using that software an APT19 incident. Source.
Who does APT19 target?
Compare any reported target profile with the assets and data relevant to your organization. A sector match is a reason to review evidence, not proof of compromise.
Primary Targets
The G0073 record includes defense, finance, energy, pharmaceuticals, telecommunications, high technology, education, manufacturing and legal services. Source.
Geographic Focus
Use the geography stated in the originating incident report. This article does not infer a fixed global footprint from the group’s Chinese-based attribution.
Notable Operations
MITRE records a 2017 phishing campaign targeting seven law and investment firms. Keep this dated observation separate from inferences about current operations. Source.
Evolution and Current Activity
Use the publication and observation dates in a technical report when discussing activity. Historical technical observations do not establish uninterrupted current operations or an operator’s business model.
Threat Assessment
Assess risk from your exposure, relevant reported behavior and incident evidence. No formal risk rating or forecast is assigned here.
How can organizations defend against APT19?
Keep software updated, restrict administrative privileges and review unexpected script execution, DLL loading and persistence changes. Use strong authentication and examine sign-ins after suspected compromise. Preserve email, endpoint and network evidence before making an attribution decision.
Conclusion
Keep the APT19 and Deep Panda uncertainty explicit in reports and response discussions. Use documented observations to guide investigation, and distinguish what a source reports from what your own evidence confirms.
Read MITRE G0073 and Unit42’s C0d0so0 analysis. Compare the separate APT19, APT41 and APT40 profiles without merging their attribution. Discuss your investigation workflow.
For vendor-risk workflows, ThreatWatch is Brandefense’s separate TPRM product.
Frequently Asked Questions
What is APT19?
APT19 is a China-aligned threat group that has run cyber espionage for over a decade. It also runs large credential harvesting campaigns.
Is APT19 the same as Deep Panda?
The post treats them as one actor. MITRE ATT&CK says some analysts track them as the same group, but open sources do not confirm it.
How does APT19 get initial access?
It mostly uses spear-phishing emails with malicious attachments or links. It also compromises web servers and content management systems with web shells.
Which sectors does APT19 target?
The post lists government, technology and telecommunications, defense, and professional services. MITRE adds finance, energy and others.
How can organizations defend against APT19?
Use MFA on all external services, train users to spot phishing, and monitor for unusual credential use. Audit web servers and hosting environments regularly.
