Threat Intelligence Tarot
Vol. II · 116
China (PLA Northeastern Theater Command, suspected)
G0131★★★★★
risk 3/5
✦ The Heartbeat ✦
Tonto Team
Karma Panda · Earth Akhlut · CactusPete · HeartBeat
RussiaMongoliaJapanSouth KoreaTaiwanDefense ministries
Active since ~2009 · Regional military intelligence, Diplomatic espionage
The Heartbeat moves on a long, slow rhythm — one campaign per quarter, one breach per year, all tuned to the pulse of regional defense procurement. It does not raise its voice, and so the alarm rarely rises with it.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Bisonal RAT campaigns spanning over a decade
- ◆ProxyLogon Exchange exploitation against Eastern European targets (2021)
- ◆Targeting of Mongolian and Russian government and military
- ◆Trend Micro Earth Akhlut attribution report (2020)
Defenses
- ▸Long-tail malware family hunts including Bisonal IOC packagesMITRE D3FEND
- ▸Macro execution policy with notification and blockingCIS Control 9 ↗
- ▸Exchange server patch SLAs with virtual patching where applicableCIS Control 7 ↗
- ▸Defense ministry SOC sharing across Northeast Asian allied nationsNIST CSF: RS.CO ↗
Reversed: Their Weakness
Reuse of Bisonal across a decade is both signature and weakness: defenders that hunted Bisonal in 2014 can hunt the 2024 variant with familiar signatures.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.