# TA428: threat group profile

> TA428 is a threat group thought to operate from China. Public reporting about it is still limited. This free profile brings together what is known about it, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/ta428
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > TA428

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 0 |
| Thought to operate from | China |
| Other names | 2 |
| Public reports | 10 |

## Who is TA428?

TA428 is a threat group thought to operate from China. Public reporting about it is still limited.

### Also known as

Colourful Panda, BRONZE DUDLEY

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Proofpoint researchers have identified a targeted APT campaign that utilized malicious RTF documents to deliver custom malware to unsuspecting victims. We dubbed this campaign “Operation LagTime IT” based on entities that were targeted and the distinctive domains registered to C&C IP infrastructure. Beginning in early 2019, these threat actors targeted a number of government agencies in East Asia overseeing government information technology, domestic affairs, foreign affairs, economic development, and political processes. We determined that the infection vector observed in this campaign was spear phishing, with emails originating from both free email accounts and compromised user accounts. Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Additionally, this APT group utilizes Poison Ivy payloads that share overlapping command and control (C&C) infrastructure with the newly identified Cotx campaigns. Based on infrastructure overlaps, post-exploitation techniques, and historic TTPs utilized in this operation, Proofpoint analysts attribute this activity to the Chinese APT group tracked internally as TA428. Researchers believe that this activity has an operational and tactical resemblance to the Maudi Surveillance Operation which was previously reported in 2013.

## Public reports about TA428

- https://www.proofpoint.com/us/threat-insight/post/chinese-apt-operation-lagtime-it-targets-government-information-technology
- https://www.recordedfuture.com/china-linked-ta428-threat-group
- https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia
- https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop
- https://blog.group-ib.com/task
- https://www.sentinelone.com/labs/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op
- https://www.youtube.com/watch?v=1WfPlgtfWnQ
- https://vb2020.vblocalhost.com/uploads/VB2020-20.pdf
- https://vb2020.vblocalhost.com/uploads/VB2020-Ozawa-etal.pdf
- https://st.drweb.com/static/new-www/news/2021/april/drweb_research_attacks_on_russian_research_institutes_en.pdf

## Frequently asked questions

### Who is TA428?

TA428 is a threat group thought to operate from China. Public reporting about it is still limited.

### Where is TA428 thought to be based?

Public reporting places TA428 as operating from China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### How do I know if TA428 is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact