Cyber Resilience

Threat actor · all actors

APT19G0073 unknown

aka APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group

Last updated: 2026-08-22

3attributed CVEs
32ATT&CK techniques
8.7IDF score (tooling uniqueness)
1exclusive CVEs
2017–2021years active

About this actor

[APT19](https://attack.mitre.org/groups/G0073) is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. In 2017, a phishing campaign was used to target seven law and investment firms. (Citation: FireEye APT19) Some analysts track [APT19](https://attack.mitre.org/groups/G0073) and [Deep Panda](https://attack.mitre.org/groups/G0009) as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016) (Citation: FireEye APT Groups) (Citation: Unit 42 C0d0so0 Jan 2016)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0073

Mandiant / genericAPT numbering

APT19

Unclassifiedno scheme matched

CodosoC0d0so0Codoso TeamSunshop Group

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 32 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2017-6328 6.98.80.02142017-08-11see CVE
CVE-2020-6789 5.87.80.00352021-03-25see CVE
CVE-2017-1099 5.44.30.35512017-06-13see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-419 / 3259%
SI-318 / 3256%
CM-217 / 3253%
CM-617 / 3253%
CA-715 / 3247%
SI-714 / 3244%
CM-712 / 3238%
AC-411 / 3234%
SI-1011 / 3234%
SC-710 / 3231%
SI-29 / 3228%
AC-68 / 3225%
AC-37 / 3222%
RA-57 / 3222%
AC-26 / 3219%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years