Threat Actor Characterization
TA459
ID: 63e4b99889b8b3794de1b6b9d211aed672071Actor Network Graph
Open Network GraphMITRE ATT&CK®
TA459 (MITRE G0062) is a China-nexus espionage actor that in April 2017 spearphished financial analysts in Russia and neighboring countries using CVE-2017-0199 to stage ZeroT and deploy PlugX; associated tooling also included NetTraveler and PCrat/Gh0st.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1566.001 | Spearphishing Attachment | TA0001 |
|
| T1203 | Exploitation for Client Execution | TA0002 |
|
| T1059.005 | Visual Basic | TA0002 |
|
| T1059.001 | PowerShell | TA0002 | |
| T1204.002 | Malicious File | TA0002 |
|
CLASSIFICATION: Unclassified / Open Source
Category: Nation-state (cyber espionage) — Origin: China (assessed)
Executive Summary
TA459 (MITRE G0062) is a cyber-espionage activity cluster assessed to operate from China, active in at least 2015–2017 and beyond, with targeting observed against Russia, Belarus, Mongolia, Central Asia and neighboring regions. In April 2017, Proofpoint documented a focused campaign against financial analysts at major firms in Russia and nearby countries using CVE-2017-0199 in Microsoft Word to stage the ZeroT loader and subsequently deploy the PlugX RAT. TA459 tradecraft includes spearphishing attachments, VBScript and PowerShell-based staging, and client-side exploitation for execution. Secondary payloads historically included PlugX, NetTraveler, and PCrat/Gh0st, with command-and-control over HTTP(S) and DNS. The group’s targeting of analysts covering the telecommunications sector indicates a collection priority on regional communications and economic intelligence. INFERENCE (confidence: medium). Overall confidence in actor characterization is high for 2017 activity and TTPs (Proofpoint, MITRE), with medium confidence for current activity scope.
- Industries/Sectors: Financial services (sell-side/buy-side analysts), government and defense/military organizations; telecom-adjacent analyst coverage.
- Geography (Region): Central and Northeast Asia; Eastern Europe.
- Countries (if available): Russia, Belarus, Mongolia (plus others in Central Asia).
- Timeframe: Publicly reported operations at least 2015–2017; profile maintained/updated by MITRE as of 2025-04-25.
Executive Analyst Brief for CISO
What: TA459 (MITRE G0062) is a China-nexus espionage actor that spearphished financial analysts in Russia and neighbors using CVE-2017-0199 Word documents to stage ZeroT and deploy PlugX; tooling also included NetTraveler and PCrat/Gh0st.