Tonto Team

Tonto Team is a Chinese government-aligned Advanced Persistent Threat (APT) group, recognized for its malicious cyber activities. The team has been active for over a decade, utilizing various types of malware, notably the Bisonal and ShadowPad backdoors, in campaigns against entities in Japan, Russia, South Korea, and more recently, India. The use of the ShadowPad backdoor, which is now part of Tonto Team's arsenal, has been identified in other China-nexus clusters such as Tick. Furthermore, the group has been linked to the ReVBShell malware, an association also shared with Tick, as confirmed by the AhnLab Security Emergency Response Center (ASEC) in April 2023. The Tonto Team has been involved in several significant cyber-espionage operations. For instance, amid the Russo-Ukrainian conflict, the group launched a campaign against Russian agencies in July 2022. Notably, following border clashes between India and China, the team targeted four regional despatch centers responsible for operating India's power grid, as revealed by Recorded Future's Insikt Group. Additionally, they have used the RoyalRoad exploit builder, a tool primarily utilized by Chinese APT groups, to weaponize decoy RTF documents for spear-phishing operations, according to threat intelligence firm Group-IB. The Tonto Team's activities extend beyond mere cyber-espionage. Unclassified analysis by the U.S.-China Economic and Security Review Commission suggests that Tonto Team may be a unit of the People's Liberation Army. This connection was highlighted following reported hacks in 2017 against several South Korean entities involved in deploying an American-made anti-ballistic missile defense system. As such, the Tonto Team poses a significant cybersecurity threat, particularly to geopolitical rivals of China.