Threat Intelligence Tarot
Vol. II · 112
China
G0013★★★★★
risk 3/5
✦ The Decade Patient ✦
APT30
Override Panda · Lotus Blossom · Spring Dragon
ASEAN governmentsDiplomatic missionsJournalistsAerospaceDefense
Active since ~2005 · Regional espionage, Political intelligence, ASEAN influence
The Decade Patient was watching when the analyst was a graduate student. Ten-year campaigns are not a strategy here — they are the natural lifespan of an operation that never needed to hurry.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Decade-long ASEAN diplomatic targeting campaign
- ◆BACKBEND, FLASHFLOOD, and SHIPSHAPE toolkit development
- ◆Air-gapped network bridging via USB worm propagation
- ◆FireEye attribution report (April 2015)
Defenses
- ▸USB device control and removable media policiesCIS Control 10 ↗
- ▸Long-term retention of EDR telemetry for retroactive huntingNIST CSF: DE.AE ↗
- ▸Air-gap network policies with one-way data diodes where feasibleNIST SP 800-82 ↗
- ▸Diplomatic mission threat briefings and travel protectionsNIST CSF: ID.RA ↗
Reversed: Their Weakness
Multi-year persistence requires multi-year tooling investment. Disclosure of malware families with consistent build artifacts allows defenders to retroactively hunt back through a decade of logs.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.