APT30

Essential information

Confidence: 100/100
Published: 16/12/2025 19:39
Modified: 27/03/2026 01:14
Updated at: 27/03/2026 01:14
Revoked: No
Author / Source: The MITRE Corporation
Resource level: —
Primary motivation: —
Related entities: 2 attack patterns (mitre), 5 malware

Description

[APT30](https://attack.mitre.org/groups/G0013) is a threat group suspected to be associated with the Chinese government. While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches.(Citation: FireEye APT30)(Citation: Baumgartner Golovkin Naikon 2015)

Marking (TLP)

External references

Related entities

SHIPSHAPE uses

Family The MITRE Corporation Confidence 100

[SHIPSHAPE](https://attack.mitre.org/software/S0028) is malware developed by [APT30](https://attack.mitre.org/groups/G0013) that allows propagation and exfiltration of data over removable devices. [APT30](https://attack.mitre.org/groups/G0013) may use this capability to exfiltrate data across air-gaps. (Citation: FireEye…

First seen 01/01/1970 · Last seen 16/11/5138 ·
SPACESHIP uses

Family The MITRE Corporation Confidence 100

[SPACESHIP](https://attack.mitre.org/software/S0035) is malware developed by [APT30](https://attack.mitre.org/groups/G0013) that allows propagation and exfiltration of data over removable devices. [APT30](https://attack.mitre.org/groups/G0013) may use this capability to exfiltrate data across air-gaps. (Citation: FireEye…

First seen 01/01/1970 · Last seen 16/11/5138 ·
NETEAGLE uses

Family The MITRE Corporation Confidence 100

[NETEAGLE](https://attack.mitre.org/software/S0034) is a backdoor developed by [APT30](https://attack.mitre.org/groups/G0013) with compile dates as early as 2008. It has two main variants known as “Scout” and “Norton.” (Citation: FireEye APT30)

First seen 01/01/1970 · Last seen 16/11/5138 ·
FLASHFLOOD uses

Family The MITRE Corporation Confidence 100

[FLASHFLOOD](https://attack.mitre.org/software/S0036) is malware developed by [APT30](https://attack.mitre.org/groups/G0013) that allows propagation and exfiltration of data over removable devices. [APT30](https://attack.mitre.org/groups/G0013) may use this capability to exfiltrate data across air-gaps. (Citation: FireEye…

First seen 01/01/1970 · Last seen 16/11/5138 ·
BACKSPACE uses

Family The MITRE Corporation Confidence 100

[BACKSPACE](https://attack.mitre.org/software/S0031) is a backdoor used by [APT30](https://attack.mitre.org/groups/G0013) that dates back to at least 2005. (Citation: FireEye APT30)

First seen 01/01/1970 · Last seen 16/11/5138 ·

Essential information

Description

Marking (TLP)

External references

Related entities

Attack patterns (MITRE) (2)

Malware (5)