Threat actor · all actors
APT12G0005 state
🇨🇳 CN
aka APT12, IXESHE, DynCalc, Numbered Panda, DNSCALC, TG-2754, BeeBus, Group 22, Calc Team, Crimson Iron, BRONZE GLOBE, Hexagon Typhoon
Last updated: 2026-08-22
About this actor
[APT12](https://attack.mitre.org/groups/G0005) is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citation: Meyers Numbered Panda)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
Microsoftweather-system names
CrowdStrikenation-animal names
Mandiant / genericAPT numbering
Secureworkscolour-metal names
Unclassifiedno scheme matched
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 9 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
- 2026 — 1 CVE published
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2026-20929 | 5.9 | 7.5 | 0.0116 | 2026-01-13 | see CVE |
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
AC-4 | 8 / 9 | 89% |
CA-7 | 8 / 9 | 89% |
SC-7 | 8 / 9 | 89% |
SI-3 | 8 / 9 | 89% |
SI-4 | 8 / 9 | 89% |
CM-2 | 6 / 9 | 67% |
CM-6 | 6 / 9 | 67% |
SC-44 | 5 / 9 | 56% |
CM-7 | 4 / 9 | 44% |
SI-2 | 4 / 9 | 44% |
SI-8 | 4 / 9 | 44% |
SC-20 | 3 / 9 | 33% |
SI-7 | 3 / 9 | 33% |
IA-9 | 2 / 9 | 22% |
SI-10 | 2 / 9 | 22% |
Co-occurring actors
- Ajax Security Team 1 shared CVEs
- APT29 1 shared CVEs
- APT38 1 shared CVEs
- Sandworm Team 1 shared CVEs
- Tonto Team 1 shared CVEs
- GOLD SOUTHFIELD 1 shared CVEs
- Scattered Spider 1 shared CVEs
- OilRig 1 shared CVEs
- Indrik Spider 1 shared CVEs
- Mustang Panda 1 shared CVEs
Similar actors
Similar TTPs
- APT30 0.44
- TA459 0.42
- Elderwood 0.31
- The White Company 0.31
- RTM 0.29
Overlapping CVEs
- C0027 1.00
- APT28 1.00
- FIN7 1.00
- OilRig 1.00
- Tropic Trooper 1.00
Active in same years
- Operation Dream Job 1.00
- SolarWinds Compromise 1.00
- C0027 1.00
- SharePoint ToolShell Exploitation 1.00
- Ke3chang 1.00
Same nation-state
- Night Dragon 1.00
- FunnyDream 1.00
- Operation Wocao 1.00
- C0017 1.00
- Cutting Edge 1.00
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00