Tonto Team

Summary

Suspected Chinese state-sponsored espionage group (MITRE G0131) active since at least 2009 against South Korea, Japan, Taiwan and the United States, and by 2020 against other Asian and Eastern European countries: government, military, energy, mining, financial, education, healthcare and technology organisations. Kaspersky tracks it as CactusPete, CrowdStrike as Karma Panda, Trend Micro as Earth Akhlut and Sophos CTU as BRONZE HUNTLEY. Its signature is the Bisonal backdoor, in use for more than ten years against Japanese, South Korean and Russian organisations. It phishes with tailored attachments (T1566.001), increasingly RTF documents built with the Royal Road weaponizer, which exploit Office Equation Editor flaws (T1203) — a builder shared by several Chinese groups, so it does not identify Tonto Team alone. In 2020 Kaspersky found a new Bisonal variant used against financial and military organisations in Eastern Europe. In March 2021 the group compromised the email servers of two Eastern European companies, and in 2021 and 2022 it tried and failed to phish Group-IB staff with Bisonal.DoubleT and a new downloader. AhnLab reported 2022–2023 activity against South Korean education, construction, diplomatic and political institutions through DLL side-loading of anti-malware files; that page could not be read here, so it is not recorded as a campaign.

Attribution

MITRE: suspected state-sponsored; Sophos CTU: moderate confidence; no government attribution on record

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Suspected Chinese state-sponsored espionage group
• Sophos CTU (Research, 2026-10)
  Operates on behalf of China (moderate confidence)

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 3

Malware and tools 4

Infrastructure patterns

• RTF lures built with the Royal Road weaponizer, shared across several Chinese groups (Group-IB, 2023)
• Phishing sent to existing addresses inside the target, tailored to the victim (Kaspersky, 2020)

Reporting and advisories 5

• MITRE ATT&CK
  Tonto Team (G0131)
• Kaspersky
  CactusPete APT group's updated Bisonal backdoor (2020)
• Cisco Talos
  Bisonal: 10 years of play (2020)
• Group-IB
  Nice try, Tonto Team (Feb 2023)
• Sophos CTU
  BRONZE HUNTLEY threat profile