Uptime Hamster: 112d 13h 17mDeploy: 23 Oct 2026 07:21Updated: 2026-07-21
PanelActoresCampanasMapaTTPs
Panel » Actores » Tonto Team
ClassicBrechasMapaActoresTTP MatrixAnaliticaAlertasCyberNewsArsenalExploitsKillChainOrigenSSLBLRansomLookRansomwhere
Logo del actor de amenaza Tonto Team

Tonto Team

1 incidentes 1 paises 1 sectores threat-actor CN Ultimo: 2026-05-25
Aliases: Earth Akhlut, BRONZE HUNTLEY, CactusPete, Karma Panda, G0131 o Seven Pointed Dagger, Bisonal (malware), Lone Ranger, Dissident groups, otros referencias en inteligencia de amenzas, Bisonal, otros mencionados en fuentes OSINT verificadas, bisonal, tonto, tontoteam
Ver en IntelTracker → APTTrail →
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).

Aliases del actor

Earth AkhlutBRONZE HUNTLEYCactusPeteKarma PandaG0131 o Seven Pointed DaggerBisonal (malware)Lone RangerDissident groupsotros referencias en inteligencia de amenzasBisonalotros mencionados en fuentes OSINT verificadasbisonaltontotontoteam

Actores similares

karma-pandaactor · 1tonto-teamactor · 1bisonalactor · 1anchor-pandaactor · 1aquatic-pandaactor · 1big-pandaactor · 1electric-pandaactor · 1eloquent-pandaactor · 1emissary-pandaactor · 1foxy-pandaactor · 1

Canales, DLS e infraestructura asociada

Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.

TipoEstadoHost / enlaceTitle / ultimo titulo
DLS / leak siteunknownduckduckgo.comTonto Team (China)
Webunknownduckduckgo.comTonto Team (China)
Webunknownattack.mitre.orgOSINT
Motivacion
Information theft and espionage
Malware asociado
win.typehash, ShadowPad, Mimikatz, win.8t_dropper, win.korlia, win.quickmute
Tecnicas MITRE
T1614, T1573, T1069.001, T1204.002, T1003, T1056
CVEs relacionadas
CVE-2021-27065, CVE-2021-26858, CVE-2021-26857, CVE-2021-26855, CVE-2018-0802, CVE-2018-0798
Victimas
0
TTPs unicas
0
Info robada historica
N/D
Rescates reclamados
N/D
Pagos detectados
N/D

Paises afectados

United States (1)

Paises objetivo (OSINT)

IndiaJapanKorea, Republic ofMongoliaTaiwan, Province of ChinaUnited States

Sectores atacados

Software (1)

Sectores objetivo (OSINT)

FinancePublic AdministrationNational Security&International AffairsMiningEnergy & Utilities Information ServicesEducational ServicesHealthCare & Social AssistanceConstruction of BuildingsInsurance