APT5

Summary

China-based espionage actor active since at least 2007 (Mandiant, MITRE G1023), tracked by Microsoft as Mulberry Typhoon (formerly MANGANESE), by CrowdStrike as Keyhole Panda and by Secureworks as BRONZE FLEETWOOD. Mandiant gives a suspected China attribution and describes a large group with several subgroups that focuses on telecommunications and technology companies, satellite-communications information, high-tech manufacturing and military-application technology in the US, Europe and Asia, with a marked interest in compromising networking devices and their software. Mandiant reports that in 2015 it compromised a US telecommunications provider and modified router images, and stole UAV and military-technology documents from a South Asian defence organisation. In December 2022 the NSA published Citrix ADC threat-hunting guidance attributing the activity to APT5; Microsoft ties Mulberry Typhoon to the CVE-2022-27518 zero-day against US defence-industrial-base devices, and Mandiant links that exploitation to the China-run SPACEHOP ORB relay network, which APT15 also uses (T1583.005). Recorded techniques include exploitation of public-facing applications (T1190), cron persistence (T1053.003) and keylogging (T1056.001). Mandiant-associated malware includes LEOUNCIA, SWEETCOLA, BRIGHTCREST, TABCTENG and AURIGA. UNC2630, the cluster behind the 2020–21 Pulse Secure zero-day intrusions against the US defence industrial base, is named as APT5 by the NSA but only as having "suspected links" by Mandiant, which tracks it; it is therefore recorded as a relationship and its campaign as assessed, not as an alias.

Attribution

No service publicly named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  China-based espionage actor
• Google Cloud / Mandiant (Research, 2026-10-17)
  Suspected attribution: China
• NSA (Government, 2022-12-13)
  Attributes the 2022 Citrix ADC exploitation to APT5; no state named in that line

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Malware and tools 5

Exploited vulnerabilities 1

Highest CVSS first.

Infrastructure patterns

• SPACEHOP (ORB3) relay network of leased VPS nodes, also used by APT15 (Mandiant, 2024)

Reporting and advisories 4

• NSA
  APT5: Citrix ADC Threat Hunting Guidance (Dec 2022)
• Mandiant
  Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day (Apr 2021)
• Mandiant
  IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders (May 2024)
• Microsoft
  Microsoft Digital Defense Report 2023