APT17

APT17, also known as Tailgator Team and Deputy Dog, is a threat actor suspected to be affiliated with the Chinese intelligence apparatus. This group has been associated with various aliases including Winnti, PassCV, Axiom, LEAD, BARIUM, Wicked Panda, and GREF. The primary targets of APT17 are the U.S. government, international law firms, and information technology companies. This group conducts network intrusions against these organizations, demonstrating sophisticated capabilities in cyber espionage. APT17 has been active since at least 2010 and is known for its expertise in supply chain attacks, exemplified by Operation Aurora, one of the most advanced cyber attacks ever conducted. The group's activities came into sharper focus following the compromise of Piriform, a software company. During this attack, APT17 managed to sign and distribute altered versions of the popular CCleaner software to a vast customer base. Kaspersky and Intezer identified notable code similarities between the backdoor implanted in CCleaner and earlier APT17 samples, using Intezer Analyze™. This shared code, a unique implementation of base64 only seen in APT17 operations, strengthens the attribution to this threat actor. APT17 is believed to be part of a loosely connected network of private contractors operating on behalf of China’s Ministry of State Security (MSS). Both APT41/Barium and APT17 have historically used the Winnti malware family, which is associated with activity linked to multiple Chinese cyber espionage operators. The discovery of these connections and code similarities underscores the ongoing threat posed by state-sponsored cyber espionage campaigns like those conducted by APT17. Two developers have been identified as being associated with APT17, further highlighting the group's ties to the Chinese state-sponsored hacking ecosystem.