APT18 / Dynamite Panda
A PLA Navy-linked espionage group with a pronounced focus on healthcare, biotechnology, and defense. Responsible for the 2014 breach of Community Health Systems, in which SSNs and PII for 4.5 million patients were exfiltrated — believed to have exploited the OpenSSL Heartbleed vulnerability. Notable for opportunistic integration of newly disclosed zero-days within days of public release, and for a technically sophisticated DNS tunneling C2 capability designed to bypass security products that do not inspect DNS traffic.
Overview
APT18 — designated Dynamite Panda by CrowdStrike, Wekby by Palo Alto Networks, SCANDIUM by Microsoft, and TG-0416 by SecureWorks — is a Chinese state-sponsored cyber espionage group attributed to the People's Liberation Army Navy and active since at least 2009. The group targets healthcare, biotechnology, pharmaceutical, aerospace, defense, telecommunications, and high-technology organizations, with a sustained and distinctive focus on the medical sector that differentiates it from many peer Chinese APT groups. Security vendors and government health agencies assess that APT18's healthcare targeting is driven not merely by intelligence value, but by China's strategic interest in accelerating domestic biomedical research, pharmaceutical development, and medical device innovation — effectively using stolen Western R&D to close a capability gap at the expense of organizations that have invested billions in that research.
APT18 came to widespread public attention in 2014 when it was attributed to the breach of Community Health Systems (CHS) — then one of the largest U.S. hospital operators, running over 200 facilities. The attackers exploited the OpenSSL Heartbleed vulnerability (CVE-2014-0160) to gain initial access, then deployed advanced malware to exfiltrate the names, addresses, phone numbers, dates of birth, and Social Security numbers of approximately 4.5 million patients. This represented one of the largest healthcare data breaches ever recorded at that time. Security researchers noted that the stolen patient data appeared to be collected not for identity fraud — the usual criminal motive — but for intelligence value: specifically, to build targeting databases for medical device development espionage, cross-referencing patient demographics with clinical treatment data to reverse-engineer Western medical technologies.
A defining characteristic of APT18 is the speed with which it weaponizes newly available exploits. When the Hacking Team breach occurred in July 2015 and a critical Adobe Flash zero-day (CVE-2015-5119) was inadvertently disclosed in the leaked data, Mandiant observed that both APT18 and APT3 had integrated the exploit into active phishing campaigns within days of its public exposure — before Adobe had issued a patch. This behavior — leveraging newly released exploits very shortly after they become available — was formally documented in Palo Alto Networks' characterization of the Wekby group and reflects either a continuous intelligence-monitoring function or an established exploit procurement operation. APT18 targeted at least 13 organizations across defense, construction, engineering, energy, healthcare, biotechnology, aerospace, high tech, non-profit, telecommunications, and transportation sectors in that single campaign window.
A second distinctive technical characteristic, documented by Palo Alto Networks Unit 42 in 2016, is APT18's use of DNS TXT records as a covert C2 channel for the Pisloader malware family. Rather than communicating over HTTP — which most enterprise security products inspect — Pisloader sends periodic DNS beacons and receives encoded commands via DNS TXT responses. This technique bypasses security products that do not correctly inspect DNS traffic, trading communication speed for stealth. Palo Alto noted this was extremely rare even among APT actors, and that the group appeared willing to accept the severe bandwidth limitation of 255 bytes per DNS message because long-term stealth was worth the operational cost.
Attribution to the PLA Navy is assessed with moderate confidence by security vendors based on operational patterns, targeting alignment with Chinese naval research priorities (defense, aerospace, biotechnology), and infrastructure characteristics. No public DOJ indictment has been filed directly against named APT18 members. In May 2019, the DOJ indicted Chinese national Fujie Wang (a/k/a Dennis Wang) and an unnamed co-conspirator for a series of intrusions including the 2015 Anthem breach — MITRE ATT&CK attributes that specific breach to Deep Panda (G0009), a separate Chinese APT cluster also known as Black Vine. Infrastructure researchers (ThreatConnect) have noted C2 domain overlap between HTTPBrowser deployments and Anthem/OPM exfiltration infrastructure, reflecting the broader shared tooling ecosystem across Chinese APT groups rather than definitive APT18 attribution for Anthem. Some sources associate APT18 with the broader "Night Dragon" and "Nitro" operation clusters; these overlaps are not conclusively resolved in public reporting. China denies all involvement.
Target Profile
APT18's targeting is among the most consistently healthcare-oriented of any documented Chinese APT group. The pivot from technology and manufacturing (documented pre-2012) to healthcare (documented from 2012 onward) coincides with Chinese government priorities around biomedical innovation and pharmaceutical independence, as reflected in successive Five Year Plans. The group's interest in medical device operational data — beyond simple patient record theft — suggests a strategic objective of reverse-engineering Western medical technologies.
- Healthcare and Hospitals: The anchor targeting sector. Community Health Systems (2014) is the most publicly documented breach, but HHS and other health sector security organizations assess that APT18's healthcare intrusions are broader than what has been publicly disclosed. Patient records, clinical treatment data, and medical device operational documentation are all collected — the latter providing insight into how Western medical devices are designed, calibrated, and maintained.
- Biotechnology and Pharmaceutical: Drug formulations, clinical trial data, pharmaceutical research, vaccine development, and treatment protocols are high-value targets. Stolen pharmaceutical IP can be used to accelerate Chinese domestic drug development or to produce generic equivalents of proprietary compounds without the R&D investment. This targeting aligns explicitly with Chinese state priorities around pharmaceutical self-sufficiency and biotechnology leadership.
- Aerospace and Defense: Consistent secondary targeting alongside healthcare. Defense contractors and aerospace firms are targeted for weapons system specifications, propulsion research, stealth technology, and procurement intelligence — consistent with PLA Navy operational interests in naval aviation, submarine warfare technology, and anti-ship missile systems.
- Telecommunications: Telecom providers are targeted both for subscriber intelligence and for the network access they represent to downstream customers — following the model common to Chinese APT groups of using trusted service providers as a vector to reach their actual targets.
- High Technology: Semiconductor design, software platforms, and engineering R&D are perennial targets, supporting China's broader technology self-sufficiency agenda. APT18 has targeted technology firms across multiple documented campaigns.
- Human Rights Organizations: NGOs working on issues of particular sensitivity to the Chinese government — democratic governance, labor rights, religious freedom, and Tibetan and Uyghur issues — are documented APT18 targets, consistent with the MSS/PLA's domestic intelligence mandate for monitoring Chinese diaspora and civil society.
- Government Entities: U.S. federal government organizations are listed in multiple APT18 attributions. APT18 has been linked in open reporting to the broader wave of Chinese APT activity against U.S. government personnel systems, which culminated in the OPM breach — though direct attribution of the OPM intrusion to APT18 specifically is not publicly confirmed.
Tactics, Techniques & Procedures
APT18 combines opportunistic zero-day exploitation with a disciplined persistence infrastructure. The group's willingness to pivot rapidly to newly disclosed vulnerabilities — integrating Hacking Team's leaked Flash exploit within days — indicates an active exploit-monitoring function and a well-organized operational pipeline. Post-compromise, the group relies on a layered toolkit: commodity RATs for flexibility, custom malware for stealth, and DNS-based C2 for long-term persistent access that evades standard detection controls.
| mitre id | technique | description |
|---|---|---|
| T1566.001 | Spear-Phishing Attachment | Primary initial access vector. APT18's phishing lures are contextually tailored — Game of Thrones content, conference invitations, industry-relevant business documents, and "Flash update" themes. In the Hacking Team Flash campaign, phishing emails used a fake Adobe Flash update pretext directing targets to a URL downloading a malicious .swf exploit file. |
| T1566.002 | Spear-Phishing Link | The Hacking Team CVE-2015-5119 campaign delivered exploits via URL rather than attachment, directing targets to attacker-controlled infrastructure hosting the malicious Flash file. APT18 used non-specific phishing emails designed for broad reuse across multiple targets simultaneously, contrasting with APT3's more tailored per-organization approach in the same campaign. |
| T1190 | Exploit Public-Facing Application | The 2014 Community Health Systems breach is believed to have exploited CVE-2014-0160 (OpenSSL Heartbleed) against internet-facing servers — reading process memory to extract session tokens, credentials, and private keys without leaving standard authentication logs. Heartbleed exploitation requires no credentials and leaves minimal forensic trace, making it a highly efficient initial access vector for a healthcare network with extensive internet-facing infrastructure. |
| T1203 | Exploitation for Client Execution | APT18 integrated CVE-2015-5119 (Adobe Flash Player use-after-free — leaked from Hacking Team) into active campaigns within days of the July 2015 Hacking Team disclosure, before Adobe had issued a patch. The exploit was delivered as a malicious .swf file that upon successful exploitation deployed a Gh0st RAT variant. APT18 has a documented history of rapidly weaponizing newly available exploit code, indicating a continuous vulnerability intelligence function. |
| T1071.004 | DNS (Application Layer Protocol) | Pisloader uses DNS TXT records as its C2 channel — a technique documented by Palo Alto Unit 42 as extremely rare among APT groups. The malware periodically sends DNS queries with a random 4-byte uppercase beacon string. The C2 server responds with a DNS TXT record containing base32-encoded commands. The group's willingness to accept the 255-byte-per-message bandwidth ceiling — making data exfiltration extremely slow — demonstrates a deliberate preference for stealth over speed in long-dwell operations. |
| T1071.001 | Web Protocols (HTTP C2) | HTTPBrowser communicates over HTTP with a User-Agent string of "HTTPBrowser/1.0" — a distinctive and detectable signature in earlier versions. C2 traffic uses HTTP for file enumeration, credential collection, and command delivery. In later campaigns, some HTTPBrowser variants switched to DNS TXT C2 (becoming what Palo Alto documented as Pisloader), suggesting an evolution toward harder-to-detect transport protocols. |
| T1027.002 | Software Packing (ROP obfuscation) | Pisloader's payload is heavily obfuscated using return-oriented programming (ROP) to control execution flow, combined with large quantities of garbage assembly instructions that perform no operation but significantly complicate reverse engineering. Each subroutine contains the bare minimum operations necessary before modifying the stack to continue execution — making automated analysis and signature extraction considerably harder. Anomali documented this as a novel anti-analysis technique when first observed in 2015. |
| T1547.001 | Registry Run Keys | Persistent access established via HKCU\Software\Microsoft\Windows\CurrentVersion\Run, ensuring backdoor execution on system reboot. The specific key value "lsm" (pointing to %appdata%\lsm.exe) is a documented indicator in Pisloader samples. Earlier HTTPBrowser samples used the Run key value "360v" or "wdm" depending on campaign generation. |
| T1021.001 | Remote Services: RDP / VPN | When phishing or exploit campaigns fail, APT18 pivots to credential-based remote access. Stolen credentials are used against internet-facing RDP, SSL VPN, Citrix, and Moka5/VNC endpoints. The group actively targets organizations without two-factor authentication, using stolen credentials as a reliable fallback when malware deployment is blocked. HcdLoader is used on externally-facing servers to provide persistent remote access as a Windows service. |
| T1053.002 | Scheduled Task via at.exe | APT18 uses at.exe for scheduled task creation for lateral movement command execution and persistence. A Dell SecureWorks analysis documented specific at.exe usage patterns for lateral movement on Windows 7 systems — creating tasks that execute malware or commands on remote systems without direct interactive login, reducing the authentication event footprint. |
| T1003 | OS Credential Dumping | Windows Credential Editor (WCE) is used for in-memory credential extraction, enabling pass-the-hash lateral movement across domain environments. Credential harvesting is central to APT18's post-compromise lateral movement — enabling access to clinical systems, medical databases, and administrative infrastructure using legitimate domain accounts. |
Known Campaigns
APT18's campaign history reflects its dual identity: a sophisticated, long-dwell espionage actor in healthcare and defense, and an opportunistic, rapidly-mobilizing operation that integrates newly available exploit code faster than patches can be deployed across enterprise environments.
Between April and June 2014, APT18 breached Community Health Systems — then operating over 200 hospitals across the United States — in what became one of the largest healthcare data breaches on record at that time. The initial access vector is believed to have been CVE-2014-0160 (OpenSSL Heartbleed), which allowed the attackers to read process memory from internet-facing CHS servers and extract session tokens and credentials without triggering authentication logs. Advanced purpose-built malware was deployed to maintain access and conduct systematic exfiltration. The attackers targeted and exfiltrated patient records — names, addresses, phone numbers, dates of birth, and Social Security numbers — for approximately 4.5 million individuals who had been treated at CHS facilities over the preceding five years. Security researchers assessed that the motive was not conventional identity fraud but medical intelligence collection: building targeting databases for medical device development espionage and cross-referencing patient demographics with treatment data to reverse-engineer Western medical technologies.
Within days of the July 2015 Hacking Team breach — in which a leaked Adobe Flash zero-day (CVE-2015-5119) was publicly exposed before a patch was available — APT18 integrated the exploit into active phishing campaigns against at least 13 organizations. Phishing emails used a generic "Flash update" pretext with URLs directing targets to attacker-controlled servers hosting the malicious .swf exploit file. Successful exploitation delivered a Gh0st RAT variant that communicated with a previously known APT18 C2 address (223.25.233.248). Mandiant documented APT18 and APT3 running independent campaigns using the same CVE simultaneously — confirming they are separate groups with separate toolchains. Targeted sectors included aerospace and defense, construction and engineering, education, energy, health and biotechnology, high tech, non-profit, telecommunications, and transportation — essentially a broad sweep of all economically and strategically valuable sectors.
Palo Alto Unit 42 documented a campaign by Wekby (APT18) against a U.S.-based high-technology company using the Pisloader malware family, notable for its use of DNS TXT records as the sole C2 channel. The dropper established persistence via Registry Run key (HKCU Run\lsm pointing to %appdata%\lsm.exe), then executed the ROP-obfuscated Pisloader payload. Pisloader beaconed periodically to a C2 DNS server (ns1.logitech-usa[.]com — a domain designed to blend with legitimate Logitech infrastructure) using random 4-byte uppercase strings. The C2 server returned commands encoded in DNS TXT responses. Commands supported by Pisloader included: collect system information, list drives and file directories, upload files, list running processes, and spawn a command shell. The use of DNS as C2 was assessed as extremely rare and was chosen specifically to bypass security products that do not inspect DNS traffic, accepting the severe bandwidth limitation in exchange for near-total traffic invisibility.
Beyond the publicly documented CHS breach, HHS and healthcare sector security organizations assess that APT18's intrusions into the U.S. healthcare sector are broader and more sustained than public reporting reflects. The group transitioned from technology and manufacturing targeting around 2012 to prioritize healthcare, and has maintained that focus consistently. Stolen data types include patient records (for targeting database construction), medical device operational parameters (for reverse engineering), pharmaceutical formulations and clinical trial data, and biomedical research documentation. This targeting profile is consistent with Chinese government Five Year Plan priorities around biomedical innovation, pharmaceutical self-sufficiency, and healthcare technology development — sectors where China has historically lagged Western competitors and has explicitly prioritized closing the gap.
The 2015 breach of health insurer Anthem — affecting 78.8 million individuals, the largest healthcare data breach in U.S. history — is attributed by MITRE ATT&CK to Deep Panda (G0009), also known as Black Vine, rather than APT18. The U.S. DOJ unsealed an indictment in May 2019 charging Chinese national Fujie Wang (a/k/a Dennis Wang) and a John Doe as part of the China-based hacking group responsible for Anthem and three other unnamed U.S. businesses. The indictment does not name APT18. Infrastructure researchers at ThreatConnect documented C2 domain registration overlap between HTTPBrowser deployments and the exfiltration infrastructure used in Anthem and the OPM breach — using the same registrant email address — which points to the shared tooling and infrastructure marketplace operating across Chinese state-sponsored APT groups, not to definitive APT18 attribution for Anthem. Understanding this boundary matters: APT18 is the confirmed CHS actor; Deep Panda/Black Vine is the confirmed Anthem actor. The two groups represent separate clusters within China's broader state-directed cyber espionage ecosystem, both targeting the same healthcare sector for aligned strategic reasons.
Tools & Malware
APT18 operates a mixed toolset combining bespoke custom malware — distinguished by technical sophistication such as ROP obfuscation and DNS tunneling — with widely available commodity RATs. The HTTPBrowser-to-Pisloader lineage shows a clear evolution toward harder-to-detect C2 transport protocols. The group also uses stolen credentials and legitimate remote access tools as operational fallbacks, reducing reliance on malware detection for persistent access.
- Pisloader: APT18's most technically sophisticated documented malware, and one of very few APT tools globally to use DNS TXT records as its sole C2 channel. Named by Palo Alto Networks Unit 42 based on sample metadata. Heavily obfuscated with custom ROP packing and garbage assembly instructions that greatly complicate reverse engineering. Communicates via DNS queries to an attacker-controlled DNS server, receiving commands in TXT record responses. Assessed as a variant of HTTPBrowser based on shared command structure, format strings, and metadata. Supports system information collection, file and drive enumeration, file upload, process listing, and remote shell spawning.
- HTTPBrowser (htpRAT): APT18's primary workhorse RAT, used across multiple campaign generations since at least 2012. Communicates over HTTP with the distinctive User-Agent "HTTPBrowser/1.0." Provides full remote access: file operations, process control, system enumeration, credential harvesting, and command execution. Shared format strings and command names confirm Pisloader is derived from the HTTPBrowser codebase. Deployed via spear-phishing and exploit delivery and widely observed across APT18 and other Chinese APT actors.
- Gh0st RAT: A publicly available Chinese-origin RAT used by APT18 as a first-stage payload after exploit delivery. Provides comprehensive remote access: file creation, manipulation, deletion, launch, and transfer; screen and audio capture; webcam access; process listing and killing; command shell; and Windows event log wiping. Deployed in the Hacking Team CVE-2015-5119 campaign as the primary post-exploitation tool. Since the source code is public, APT18 and other groups tailor it by adding or removing functionality.
- hcdLoader: A loader used by APT18 to maintain persistent remote access on externally facing servers, installed as a Windows service. Documented by Anomali as a preference for the group when targeting organizations that rely on RDP or VPN for remote management. Acts as a stable persistence mechanism independent of the primary backdoor family.
- StickyFingers: A credential harvesting tool used alongside Windows Credential Editor (WCE) for post-compromise credential extraction. Used to enable lateral movement across domain-joined systems and to harvest authentication material for remote access fallback operations.
- Poison Ivy: A commodity RAT observed in APT18-associated infrastructure during Pisloader campaigns. A Poison Ivy sample found alongside Pisloader used the C2 domain intranetwabcam[.]com, with admin as the mutex password — providing a second persistent access channel operating independently of Pisloader's DNS tunnel.
- PlugX: A modular, widely-used Chinese APT RAT deployed by APT18 in some campaigns for persistent C2. PlugX provides a plugin-based architecture that can be extended with additional capabilities post-installation, allowing operators to load new modules without deploying a new implant.
- Windows Credential Editor (WCE) / HTRAN: WCE enables in-memory credential dumping including pass-the-hash attack capability without requiring password cracking. HTRAN is a connection bouncer/proxy tool used to route traffic through intermediate hosts, obscuring the origin of connections to C2 infrastructure and complicating attribution and blocking.
- AtNow (at.exe scheduling): APT18 uses Windows' built-in at.exe scheduler for lateral movement command execution on remote systems and for scheduling malware execution at specified times — a technique documented in a 2014 Dell SecureWorks analysis focused on APT18's lateral movement patterns on Windows 7 environments.
Indicators of Compromise
APT18 IOCs are drawn from Palo Alto Unit 42's 2016 Pisloader/Wekby analysis, Anomali's 2015 Wekby ROP analysis, and Mandiant's 2015 Hacking Team campaign documentation. Infrastructure indicators are historical; behavioral indicators are durable.
Infrastructure IOCs from 2014–2016 campaigns should be treated as historical reference only. Current APT18 operations will use fresh infrastructure. Behavioral indicators — DNS TXT C2 patterns, ROP-obfuscated payloads, HTTPBrowser User-Agent strings — are more durable detection anchors.
Mitigation & Defense
APT18 is assessed as active. Healthcare, biotechnology, pharmaceutical, and defense organizations are the highest-risk sectors. The group's combination of Heartbleed-class infrastructure exploitation, zero-day phishing, and DNS-tunneled long-dwell implants requires defenses spanning network perimeter, endpoint, and DNS inspection layers.
- DNS Traffic Inspection and Anomaly Detection: APT18's Pisloader C2 operates entirely over DNS — a protocol that many enterprise security stacks do not inspect at the content level. Deploy DNS security solutions capable of analyzing DNS TXT record content, flagging unusual query frequencies, and alerting on high-entropy or base32-encoded TXT record responses. Monitor for DNS queries to newly registered or low-reputation domains, particularly those resembling legitimate vendor names (e.g., logitech-usa[.]com). Baseline normal DNS TXT record usage in your environment — it is minimal for standard enterprise workloads, making anomalies detectable.
- Heartbleed and OpenSSL Patching Completeness: CVE-2014-0160 was patched in April 2014. Any environment still running a vulnerable OpenSSL version is exposed to a documented APT18 initial access technique. Run authenticated vulnerability scans against all internet-facing servers to confirm OpenSSL version currency — do not assume patch compliance without verification. Note that many embedded systems, network appliances, and legacy healthcare devices may still run vulnerable OpenSSL builds that cannot be easily updated.
- Rapid Patch Deployment for High-Severity Vulnerabilities: APT18's documented integration of CVE-2015-5119 within days of the Hacking Team leak underscores that this group does not wait for enterprises to patch. Maintain an emergency patch deployment process for CVSSv3 9.0+ or CISA KEV-listed vulnerabilities that can push patches to all endpoints within 24–48 hours of availability — not the standard 30-day enterprise cycle. Adobe Flash is retired (end-of-life December 2020) and should be completely absent from all endpoints.
- Two-Factor Authentication on All Remote Access: APT18 explicitly targets organizations without MFA, using stolen credentials against RDP, VPN, Citrix, and other remote access services as a malware-free intrusion path. Enforce MFA on every internet-facing remote access service with no exceptions. Prioritize healthcare organizations' EHR access portals, clinical workstation management systems, and medical device management interfaces — all of which represent APT18-relevant attack surfaces.
- HTTPBrowser User-Agent Monitoring: The User-Agent string "HTTPBrowser/1.0" is a documented and distinctive APT18 C2 indicator. Add it to outbound proxy alert rules. More broadly, deploy network detection and response (NDR) capable of identifying anomalous HTTP user-agents and inspecting outbound connections to newly-registered or categorized-unknown domains.
- Medical Device and Clinical Network Segmentation: APT18's interest in medical device operational data suggests clinical network infrastructure is a target. Segment clinical networks from corporate IT infrastructure, apply strict access controls on medical device management interfaces, and ensure medical devices are included in vulnerability scanning programs — even where vendor patch support is limited.
- Pharmaceutical and Biotech IP Protection: Organizations holding pharmaceutical formulations, clinical trial data, and biomedical research should apply data-centric security: classify and tag high-value research data, enforce access logging and alerting on bulk reads or downloads of research databases, and implement DLP rules that detect and alert on anomalous outbound transfers of scientific data formats (CSV with clinical headers, proprietary research file types, large genomic datasets).
APT18's pivot to healthcare espionage around 2012 predated the COVID-19 pandemic's transformation of biomedical research into a front-line geopolitical priority. The group's sustained, multi-year targeting of pharmaceutical, vaccine, and medical device research — combined with China's subsequent announcement of aggressive domestic biomedical development goals — represents one of the clearest documented examples of systematic state-directed intellectual property theft feeding directly into national industrial policy. Healthcare organizations should treat APT18 as an active, ongoing threat and not a historical artifact. The HHS HC3 advisory infrastructure specifically tracks this group as a priority concern for the healthcare sector, and the post-pandemic expansion of Chinese state interest in biomedical intelligence collection has if anything intensified the threat environment this group operates in.
Sources & Further Reading
Attribution and references used to build this profile.
- MITRE ATT&CK — Group G0026: APT18
- Palo Alto Unit 42 — New Wekby Attacks Use DNS Requests as Command and Control Mechanism (2016)
- Mandiant (Google Cloud) — Demonstrating Hustle: APT18 and APT3 Exploit Hacking Team Flash Zero-Day (2015)
- Anomali — Evasive Maneuvers: Wekby Group with Custom ROP-packing and DNS Covert Channels (2015)
- HIPAA Journal — HC3: Chinese APT Groups Targeting the Healthcare Sector (2023)
- HHS HC3 — Chinese APT Groups Targeting the Healthcare Sector (Analyst Note, 2023)
- Council on Foreign Relations — Cyber Operations Tracker: APT 18
- Malpedia — APT18 Actor Profile
- MITRE ATT&CK — Software S0124: Pisloader
- U.S. Department of Justice — Member of Sophisticated China-Based Hacking Group Indicted (Fujie Wang / Anthem) (May 9, 2019)
- Threatpost — APT Gang Branches Out to Medical Espionage in Community Health Breach (2014)