Log in Request a demo

Threat group profile

APT19

Also known as Codoso, C0d0so0, Codoso Team

MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal and other industries, with activity reported in 2014 and 2017.

In short

MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal and other industries, with activity reported in 2014 and 2017. Only MITRE ATT&CK documents this group, no government advisory names it, and MITRE says it is unclear whether APT19 and Deep Panda are the same group.

Last updated 10 October 2026

Profile MapThreat Group
  1. Attributed OriginChina
  2. Names5names in public reportsAPT19 · Codoso · C0d0so0
  3. Sectors8named as targetsDefense industry · Finance and investment firms · Law firms
  4. Techniques12in the attack chainResource Development · Initial Access · Execution
  5. Tools4tools and malware listedCobalt Strike · Empire · HTTP malware variant

In one minute

Who they are
MITRE ATT&CK describes APT19 as a Chinese-based threat group, also listed as Codoso, C0d0so0, Codoso Team and Sunshop Group. Only MITRE ATT&CK documents this group; no government advisory names it.
Who they target
MITRE lists defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing and legal services, and a 2017 phishing campaign against seven law and investment firms.
How they usually get in
Spearphishing emails with RTF and XLSM attachments, and a 2014 watering hole attack on forbes.com, as MITRE describes.
What stands out
The record is thin and dated: MITRE reports 2014 and 2017 activity only. MITRE says it is unclear if APT19 and Deep Panda are the same group, and keeps them separate.
What to do first
Filter risky email attachments, train staff on phishing, restrict PowerShell and Regsvr32 with application control, and keep browsers updated.

Names

Public reports use several names for this activity.

Names used for APT19
NameWhere it appears
APT19 Main name on the MITRE ATT&CK group page G0073[1]
Codoso MITRE ATT&CK Associated Groups list for G0073[1]
C0d0so0 MITRE ATT&CK Associated Groups list for G0073[1]
Codoso Team MITRE ATT&CK Associated Groups list for G0073[1]
Sunshop Group MITRE ATT&CK Associated Groups list for G0073[1]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK Page created 17 October 2018, last modified 31 July 2026

    Describes APT19 as a Chinese-based threat group that has targeted defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing and legal services.[1]

  • MITRE ATT&CK Page last modified 31 July 2026

    Lists Codoso, C0d0so0, Codoso Team and Sunshop Group as associated groups.[1]

  • MITRE ATT&CK Page last modified 31 July 2026

    Says a phishing campaign in 2017 targeted seven law and investment firms.[1]

  • MITRE ATT&CK Page last modified 31 July 2026

    Says some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if the groups are the same.[1, 2]

  • MITRE ATT&CK Page last modified 31 July 2026

    Describes Deep Panda, on a separate page, as a suspected Chinese threat group.[2]

Where sources differ

Only MITRE ATT&CK documents this group. No government advisory, indictment or sanction found names APT19, Codoso or Deep Panda. MITRE says some analysts track APT19 and Deep Panda as the same group, but it is unclear from open source information if they are the same, and it keeps them as two separate entries (G0073 and G0009). The Deep Panda entry is the one that mentions the Anthem intrusion, so that intrusion should not be read as APT19 activity.

Who they target

Sectors

  • Defense industryMITRE ATT&CK lists defense among the industries APT19 has targeted.[1]
  • Finance and investment firmsMITRE lists finance, and says a 2017 phishing campaign targeted seven law and investment firms.[1]
  • Law firmsMITRE lists legal services, and the 2017 phishing campaign it describes included law firms.[1]
  • Energy sectorMITRE ATT&CK lists energy among the targeted industries.[1]
  • Pharmaceutical sectorMITRE ATT&CK lists pharmaceutical among the targeted industries.[1]
  • Telecom sectorMITRE ATT&CK lists telecommunications among the targeted industries.[1]
  • Technology sectorMITRE ATT&CK lists high tech among the targeted industries.[1]
  • Education and manufacturingMITRE ATT&CK lists both among the targeted industries.[1]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. 2014

    Watering hole on forbes.com

    MITRE ATT&CK says APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets. A watering hole is a trusted website that attackers booby-trap to infect its visitors.[1, 6]

  2. 2017

    Phishing campaign against law and investment firms

    MITRE ATT&CK says a phishing campaign in 2017 was used to target seven law and investment firms.[1]

  3. 17 October 2018

    MITRE profile created

    MITRE ATT&CK created the APT19 group page G0073.[1]

  4. 31 July 2026

    MITRE profile last modified

    The MITRE page was last modified on this date, version 1.6. This is a profile update, not new activity.[1]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Resource Development

  • Obtain Capabilities: Tool T1588.002

    MITRE says APT19 obtained and used publicly available tools like Empire.[1, 16]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    MITRE says APT19 sent spearphishing emails with malicious RTF and XLSM attachments to deliver initial exploits.[1, 5]

  • Drive-by Compromise T1189

    MITRE says APT19 performed a watering hole attack on forbes.com in 2014.[1, 6]

Execution

  • User Execution: Malicious File T1204.002

    MITRE says APT19 tried to get users to open malicious attachments delivered by email.[1, 12]

  • Command and Scripting Interpreter: PowerShell T1059.001

    MITRE says APT19 used PowerShell commands to run payloads.[1, 7]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    MITRE says an APT19 HTTP malware variant sets a Registry Run key to survive reboots.[1, 10]

  • Create or Modify System Process: Windows Service T1543.003

    MITRE says an APT19 Port 22 malware variant registers itself as a Windows service.[1, 15]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    MITRE says APT19 used HTTP for command and control, the link back to the attacker.[1, 11]

Stealth

  • System Binary Proxy Execution: Regsvr32 T1218.010

    MITRE says APT19 used Regsvr32 to bypass application control.[1, 8]

  • Hijack Execution Flow: DLL T1574.001

    MITRE says APT19 launched two malware variants through a legitimate program that loaded a malicious DLL.[1, 9]

  • Hide Artifacts: Hidden Window T1564.003

    MITRE says APT19 hid PowerShell windows with the hidden window style.[1, 14]

  • Obfuscated Files or Information: Encrypted/Encoded File T1027.013

    MITRE says APT19 used Base64 to disguise payloads.[1, 13]

Tools and malware

  • Cobalt Strike Commercial remote access tool

    MITRE lists it as software used by APT19; MITRE describes it as a commercial, full-featured remote access tool.[1, 3]

  • Empire Open-source post-exploitation framework

    MITRE says APT19 obtained and used publicly available tools like Empire.[1, 4]

  • HTTP malware variant Unnamed malware

    MITRE describes an APT19 variant that talks to its server over HTTP and sets a Registry Run key.[1]

  • Port 22 malware variant Unnamed malware

    MITRE describes an APT19 variant that registers itself as a Windows service and changes Registry keys.[1]

Detection and defense

  1. Filter and train on email

    MITRE advises blocking unknown attachment types, using SPF, DKIM and DMARC, and training users to spot phishing, because APT19 used RTF and XLSM attachments.

    Counters T1566.001 T1204.002

  2. Restrict PowerShell

    MITRE advises Constrained Language mode, signing scripts, application control and removing PowerShell where it is not needed.

    Counters T1059.001 T1564.003

  3. Control Regsvr32

    MITRE advises application control such as AppLocker or Windows Defender Application Control to stop Regsvr32 being used to bypass it.

    Counters T1218.010

  4. Block DLL side-loading

    MITRE advises application control that blocks DLLs loaded by legitimate software, and restricting library loading.

    Counters T1574.001

  5. Keep browsers updated

    MITRE advises keeping browsers and plugins updated and using modern browsers with security features turned on, against watering hole attacks.

    Counters T1189

  6. Watch outbound web traffic

    MITRE advises restricting and monitoring outbound HTTP and HTTPS from critical servers to approved destinations.

    Counters T1071.001

  7. Watch autostart keys

    MITRE says this technique cannot be easily stopped by preventive controls, so watch for new Run key entries that point to unusual files.

    Counters T1547.001

  8. Flag disguised payloads

    MITRE advises anti-virus and Windows Attack Surface Reduction rules to block obfuscated scripts.

    Counters T1027.013

What Brandefense can do

Questions

What is APT19?

MITRE ATT&CK describes APT19 as a Chinese-based threat group. Only MITRE ATT&CK documents it; no government advisory names the group.

Is APT19 the same as Deep Panda?

Unclear. MITRE says some analysts track them as the same group, but it is unclear from open source information if they are. MITRE keeps separate entries.

Who does APT19 target?

MITRE lists defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing and legal services, and a 2017 phishing campaign against seven law and investment firms.

How does APT19 get in?

MITRE describes spearphishing emails with RTF and XLSM attachments and a 2014 watering hole attack on forbes.com.

What tools does APT19 use?

MITRE lists Cobalt Strike and Empire, plus two unnamed malware variants, one using HTTP and one using port 22.

What should a company do first?

Filter and train on email attachments, restrict PowerShell and Regsvr32, and keep browsers updated.

In our research

  1. APT19 (DEEP PANDA): A Persistent China-Aligned Espionage and Credential Theft Actor March 2026
  2. APT15 (Ke3Chang / Nylon Typhoon): China-Aligned Cyber Espionage APT January 2026

Sources

  1. APT19, Group G0073 MITRE ATT&CK Supports: Description, associated groups, techniques, software, targets, 2014 and 2017 activity, version and dates
  2. Deep Panda, Group G0009 MITRE ATT&CK Supports: Separate MITRE entry; unclear if the same group as APT19
  3. Cobalt Strike, Software S0154 MITRE ATT&CK Supports: Tool description
  4. Empire, Software S0363 MITRE ATT&CK Supports: Tool description
  5. Phishing: Spearphishing Attachment, Sub-technique T1566.001 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  6. Drive-by Compromise, Technique T1189 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  7. Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  8. System Binary Proxy Execution: Regsvr32, Sub-technique T1218.010 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  9. Hijack Execution Flow: DLL, Sub-technique T1574.001 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  10. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 MITRE ATT&CK Supports: Technique name, tactic and detection note
  11. Application Layer Protocol: Web Protocols, Sub-technique T1071.001 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  12. User Execution: Malicious File, Sub-technique T1204.002 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  13. Obfuscated Files or Information: Encrypted/Encoded File, Sub-technique T1027.013 MITRE ATT&CK Supports: Technique name, tactic and mitigations
  14. Hide Artifacts: Hidden Window, Sub-technique T1564.003 MITRE ATT&CK Supports: Technique name and tactic
  15. Create or Modify System Process: Windows Service, Sub-technique T1543.003 MITRE ATT&CK Supports: Technique name and tactic
  16. Obtain Capabilities: Tool, Sub-technique T1588.002 MITRE ATT&CK Supports: Technique name and tactic

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more

Technique

Phishing (T1566): ATT&CK Technique

Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.

Read more

Technique

Drive-by Compromise

Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing.

Read more