Threat Intelligence Tarot
Vol. II · 109
China
G0025★★★★★
risk 4/5
✦ The Hidden Lynx ✦
APT17
Aurora Panda · Deputy Dog · Hidden Lynx · Tailgater Team
DefenseTechnologyFinanceGovernmentSecurity industry
Active since ~2009 · Espionage, Intellectual property theft, Contract cyber operations
The Hidden Lynx hunts upstream. It does not breach the fortress — it poisons the road, the well, the seller of swords. By the time the defenders meet it, they are already drinking from its cup.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Operation Aurora (2010, jointly attributed)
- ◆DeputyDog campaign (2013)
- ◆Bit9 trust certificate breach (2013)
- ◆9002 RAT and Naid backdoor deployments
Defenses
- ▸Code-signing certificate protection with HSM and air-gapped keysNIST SP 800-57 ↗
- ▸Browser hardening and isolation for high-risk usersCIS Control 9 ↗
- ▸Watering-hole detection via web filtering and URL reputationNIST CSF: DE.CM ↗
- ▸Supply chain risk management for security vendors and signed binariesNIST CSF: ID.SC ↗
Reversed: Their Weakness
The Bit9 breach exposed APT17's pattern: compromise the security vendor, sign the malware, walk through the front door. Once defenders treat security tooling as a high-trust target, that elegance evaporates.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.