Cyber Resilience

Threat actor · all actors

APT30G0013 state

🇨🇳 CN

aka APT30, G0013, ISTHMUS CASTLE

Last updated: 2026-08-20

0attributed CVEs
4ATT&CK techniques
0.0IDF score (tooling uniqueness)
0exclusive CVEs
—years active

About this actor

[APT30](https://attack.mitre.org/groups/G0013) is a threat group suspected to be associated with the Chinese government. While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches.(Citation: FireEye APT30)(Citation: Baumgartner Golovkin Naikon 2015)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0013

Mandiant / genericAPT numbering

APT30

Unclassifiedno scheme matched

ISTHMUS CASTLE

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 4 ATT&CK techniques on file.
Named victims
None on file.

Thin data: Only 4 ATT&CK techniques mapped — a thin behavioural profile; absence is not evidence of a narrow toolkit.

See how actor data is built for the full pipeline.

Activity timeline

No activity events recorded.

Profile

CVERiskCVSSEPSSPublishedProducts
No attributed CVEs.

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
AC-44 / 4100%
CA-74 / 4100%
CM-24 / 4100%
CM-64 / 4100%
SC-444 / 4100%
SC-74 / 4100%
SI-34 / 4100%
SI-44 / 4100%
SI-84 / 4100%
SI-23 / 475%
CM-72 / 450%
IA-92 / 450%
SC-202 / 450%
SI-102 / 450%
SI-72 / 450%

Co-occurring actors

None.

Similar actors

Similar TTPs

Same nation-state

Same category