APT40
Chinese state-sponsored cyberespionage actor publicly attributed to the Ministry of State Security (MSS) Hainan State Security Department. Targets maritime industries, defense, government, and research aligned with PRC strategic priorities — naval technology, South China Sea, and the Belt and Road Initiative. U.S. DOJ indicted four MSS officers in 2021.
Aliases
Motivations
Target sectors
Target countries
Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
MITRE ATT&CK techniques
Timeline
2 events- AdvisoryHigh2024-07-08·CISA
Five Eyes joint advisory AA24-190A on APT40 tradecraft
ASD's ACSC led a Five Eyes plus Japan, Republic of Korea, and Germany joint advisory detailing APT40's tradecraft, including rapid exploitation of newly disclosed public-facing vulnerabilities and use of compromised SOHO devices as operational infrastructure.
five-eyesmsstradecraft - IndictmentHigh2021-07-19·U.S. Department of Justice
DOJ indicts four MSS Hainan officers tied to APT40
The U.S. Department of Justice unsealed an indictment charging four Chinese nationals — three Ministry of State Security (MSS) officers from the Hainan State Security Department and one contractor — with a multi-year global computer intrusion campaign targeting research institutions, universities, and private-sector victims across more than a dozen countries.
dojindictmentmss
Indicators of compromise
3 indicators| Type | Value | First seen | Source |
|---|---|---|---|
| Domain | Typosquat of Thyssenkrupp Marine Systems (German naval shipbuilder) listed in the domain appendix of CISA AA21-200A as APT40 infrastructure - consistent with the Hainan State Security Department's interest in naval technology. | Jul 18, 2021 | CISA |
| Domain | Typosquat of `huntingtoningalls.com` (Huntington Ingalls Industries, a U.S. Navy shipbuilder) listed in the domain appendix of CISA AA21-200A. Characteristic of APT40's MSS Hainan-directed targeting of the U.S. maritime defense industrial base. | Jul 18, 2021 | CISA |
| Name | family · AIRBREAK AIRBREAK (a.k.a. Orz) JavaScript-based backdoor enumerated in the malware-family list of CISA AA21-200A as part of APT40's toolkit. Cross-referenced to MITRE S0229. | Jul 18, 2021 | CISA |
Related actors
shared ATT&CK techniques- CN · ChinaAPT103 shared techniques
- KP · DPRKAndariel2 shared techniques
- RU · RussiaAPT282 shared techniques
- CN · ChinaAPT312 shared techniques
- IR · IranAPT332 shared techniques
- IR · IranAPT342 shared techniques
References
cite this page
Threat Intel Tracker. (2026-05-19). APT40 — actor profile. Retrieved from https://threatintel.local/actors/apt40