Threat Intelligence Tarot
Vol. II · 110
China
G0073★★★★★
risk 3/5
✦ The Counting House ✦
APT19
Codoso · C0d0so0 · Sunshop Group · Deep Panda variant
Financial servicesLaw firmsInvestment bankingTechnologyHealthcare
Active since ~2013 · Economic espionage, Financial intelligence
The Counting House does not steal money. It steals the moments before money moves — the unannounced merger, the unfiled patent, the unsigned settlement. Profit flows naturally from foreknowledge.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Forbes.com watering hole (2014)
- ◆Law firm intrusions ahead of major M&A announcements
- ◆Healthcare insurance plan compromises
- ◆Forbes Thought of the Day widget weaponization
Defenses
- ▸Deal-team data segregation with project-specific access boundariesCIS Control 6 ↗
- ▸Browser isolation for high-value finance and legal usersCIS Control 9 ↗
- ▸Email exfiltration monitoring with DLP on sensitive mattersNIST CSF: PR.DS ↗
- ▸Pre-announcement insider activity correlation with security eventsNIST CSF: DE.AE ↗
Reversed: Their Weakness
Insider trading enforcement and SEC scrutiny of unusual market moves narrow this operator's window. The intelligence is only valuable while still secret.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.