APT30

Overview

When FireEye's Singapore-based labs team examined malware predominantly targeting entities in Southeast Asia and India in April 2015, what they uncovered was not a recently formed group capitalizing on new vulnerabilities. They were looking at a decade of continuous, disciplined state-sponsored espionage — an operation that had been running since at least 2005 with controller software that appears to have been developed as early as 2004. FireEye designated the group APT30 in their landmark report "APT30 and the Mechanics of a Long-Running Cyber Espionage Operation," which remains the foundational public documentation of this actor. Other vendor designations: Override Panda (CrowdStrike), Bronze Geneva / Bronze Sterling / CTG-5326 (SecureWorks), and Raspberry Typhoon / RADIUM (Microsoft). The Microsoft MSTIC public naming map lists APT30 as an "Other name" for Raspberry Typhoon — though MITRE ATT&CK maintains a separate entry for Lotus Blossom (G0030, also tagged Raspberry Typhoon/RADIUM by Microsoft), generating a source of confusion in community reporting. Per MITRE, APT30 (G0013) and Lotus Blossom (G0030) are distinct tracked groups; some community sources, including Malpedia and Cyble, collapse them.

What distinguishes APT30 from virtually every other documented Chinese APT group is not technical sophistication in the conventional sense — the group does not rely on zero-day exploits, and its individual malware components are not more advanced than those used by peer groups. What distinguishes APT30 is its operational longevity and mission consistency. For more than a decade, the group pursued the same targets using the same core toolset, refining and evolving its malware through a structured, versioned development process rather than replacing tools. The BACKSPACE backdoor family dates to at least 2005 and was still in use at the time of the 2015 report. The group's controller software — a full-featured GUI application called the "NetEagle Remote Control System" — indicates a professional, organized development environment with built-in version management, target prioritization, shift-work indicators, and automated update distribution.

APT30's mission is narrow and geopolitically coherent: the group focuses on acquiring sensitive intelligence about Southeast Asian political dynamics, ASEAN deliberations and summit outcomes, territorial disputes in the South China Sea, India-China military relations, and information about journalists and media organizations covering topics of relevance to China's government and the Communist Party's legitimacy. FireEye assessed that APT30 does not appear to be motivated by financial gain or the theft of commercially valuable intellectual property in the conventional sense. The stolen data — government documents, diplomatic correspondence, military assessments, journalistic source networks — serves the information requirements of a state that needs to understand, anticipate, and in some cases suppress political developments across its region.

A feature built into APT30's toolkit from the very beginning of documented operations in 2005 — earlier than many other APT campaigns — is the capability to cross air-gapped networks. The SHIPSHAPE, SPACESHIP, and FLASHFLOOD tools form a relay system that infects removable drives attached to internet-connected machines, carries malware into air-gapped environments when those drives are physically moved to isolated systems, collects files and data from the air-gapped host, and stages the collected data for exfiltration when the drive is reinserted into an internet-connected machine. This architecture reflects a deliberate intelligence assessment: the most sensitive government and military systems are not connected to the internet, and reaching them requires crossing the physical security boundary through the one vector that does — a USB drive carried by a human.

Target Profile

APT30's targeting is among the most geographically and thematically concentrated of any documented Chinese APT. Where groups like APT1 swept broadly across industrial sectors and APT18 focused on healthcare IP, APT30 has a single intelligence mandate: Southeast Asia and India, with attention to whatever threatens the stability, legitimacy, or strategic position of the Chinese state in its immediate region.

• ASEAN Member State Governments: The Association of Southeast Asian Nations and its ten member states — Vietnam, Thailand, Malaysia, Indonesia, Philippines, Singapore, Myanmar, Cambodia, Laos, and Brunei — are the central targeting focus. APT30 deployed ASEAN-themed infrastructure and customized tooling around specific ASEAN summits, with customized malware deployed in the weeks before the January and April 2013 summits. Summit outcomes, diplomatic positions, and member state negotiations on South China Sea issues are the primary intelligence targets.
• India: A consistent secondary focus, reflecting ongoing India-China territorial disputes and military competition. FireEye documented specific spear-phishing lures referencing Indian aircraft carrier programs and oceanographic monitoring processes, indicating a specific interest in Indian naval activity and maritime capability in disputed waters. Indian aerospace companies and telecommunications firms are documented victims.
• South China Sea Claimants: Vietnam, Malaysia, and the Philippines — all involved in overlapping territorial disputes with China in the South China Sea — receive particular attention. Intelligence collection on military deployments, diplomatic positions, and alliance coordination between these states and the United States is consistent with the group's documented lure content.
• Journalists and Media Organizations: APT30 explicitly targets media organizations and journalists who cover Southeast Asian affairs, China-related topics, and stories that could embarrass or undermine the CCP's domestic or international legitimacy. The group's lures impersonating media topics and its documented interest in journalistic source networks indicate a combined collection and counter-journalism mandate.
• Regional Government Ministries: Finance ministries, foreign affairs ministries, defense ministries, and intelligence agencies across ASEAN are targeted for policy documents, diplomatic cables, military assessments, and strategic planning materials that illuminate government decision-making on topics of interest to China.
• Think Tanks and Political Analysts: Organizations and individuals analyzing Southeast Asian politics, China's regional influence, and ASEAN affairs are targeted to identify the intellectual and analytical community shaping policy positions that China seeks to understand and anticipate.
• Saudi Arabia and South Korea: Documented secondary targets beyond the core Southeast Asian focus, suggesting APT30's intelligence mandate extends to other regions of strategic interest to the Chinese state, particularly on energy and alliance relationships.

Tactics, Techniques & Procedures

APT30's TTPs are defined less by technical novelty and more by disciplined consistency and organizational sophistication. The group uses a professional, well-maintained controller application with GUI-based target management, shift-work indicators, and automated update distribution. No zero-days have been observed. The group succeeds because its targets are not well-defended — and because ten years of refinement applied to a stable, known-to-work toolkit is more operationally reliable than constantly introducing new, untested tools.

mitre id	technique	description
T1566.001	Spear-Phishing Attachment	Primary initial access method. Malicious DOC attachments containing APT30's backdoor families (BACKSPACE, NETEAGLE) are delivered via spear-phishing campaigns. Lures are consistently topical to the target's work — regional security issues, ASEAN summit agendas, India-China military relations, South China Sea territorial disputes, and media topics relevant to journalists. FireEye explicitly noted that lures are crafted to reflect the specific professional interests of recipients, not generic phishing themes.
T1091	Replication Through Removable Media	SHIPSHAPE infects removable drives attached to compromised internet-connected machines, hiding original files on the drive and replacing visible items with SPACESHIP executable copies named after the original files. When a victim inserts the infected drive into an air-gapped machine and opens what appears to be a legitimate document, SPACESHIP executes, infecting the isolated system. This is APT30's mechanism for crossing air-gaps — built in since 2005.
T1025	Data from Removable Media	SPACESHIP and FLASHFLOOD collect files from air-gapped hosts based on specified file extensions, staging the collected data to a hidden directory on the removable drive. When the drive is reinserted into an internet-connected machine infected with SHIPSHAPE, FLASHFLOOD retrieves the staged data and passes it to the BACKSPACE controller for exfiltration. The round-trip collection cycle is: infect drive → human carries drive to air-gapped machine → SPACESHIP/FLASHFLOOD collects data → human carries drive back → data exfiltrated.
T1071.001	Web Protocols — Two-Stage C2	BACKSPACE and NETEAGLE use a two-stage C2 architecture to balance stealth with scalability. Stage one is automated: victim hosts contact an initial C2 domain via HTTP to receive configuration and determine whether to connect to stage two. Stage two involves interactive operator control via the BACKSPACE controller GUI. This staging means operators are not directly interacting with every infected host continuously — they review prioritized hosts and escalate to active control selectively, reducing the chance of detection through anomalous C2 traffic patterns.
T1547.001	Registry Run Keys / Startup Folder	BACKSPACE achieves persistence via multiple documented methods depending on variant: shortcut (.lnk) files placed in the Windows Startup folder, service DLL installation, and Registry Run keys. SHIPSHAPE achieves persistence on infected removable drives via a shortcut in the drive's Startup path. The use of multiple persistence mechanisms across variants reflects the group's modular development approach and testing of different persistence strategies against evolving endpoint defenses.
T1568.001	Dynamic DNS Resolution	APT30 frequently registers its own DNS domains for C2 activities and has reused infrastructure over multi-year periods. Some domains have appeared in malware samples across many years of continuous operation. The BACKSPACE controller-backdoor communication uses HTTP requests with a file named "dizhi.gif" in the URL path — a recognizable C2 traffic pattern that serves as a behavioral indicator across campaign generations.
T1083	File and Directory Discovery	BACKSPACE, SPACESHIP, and FLASHFLOOD all include file enumeration capability. SPACESHIP collects specific file extensions from air-gapped machines; FLASHFLOOD has similar enumeration and collection logic. The BACKSPACE controller includes an "Automatically Execute Custom Task" command that retrieves data from predefined paths on victim hosts used as staging locations by both BACKSPACE and the air-gap tools, linking the networked and physical collection infrastructure.
T1027	Obfuscated Files or Information	APT30 malware uses consistent mutex and event naming conventions (e.g., containing "Microsoft" or "ZJ") across tools to manage execution and prevent duplicate instances. Malware is implemented with embedded version information, enabling automatic self-updates from C2 infrastructure. The disk serial number authentication in some BACKSPACE variants ties specific backdoor instances to specific victim hosts, limiting the utility of captured samples for analysis in non-original environments.

Known Campaigns

APT30's "campaigns" are better understood as a single continuous, decade-long intelligence collection operation with periodic intensifications around geopolitically significant events — particularly ASEAN summits. The group's infrastructure reuse over many years means that individual campaigns are difficult to cleanly separate; they represent waves within an unbroken operational tide.

Tools & Malware

APT30's toolkit is unified by a coherent, professional development philosophy: version-controlled, modularly designed, with consistent mutex naming conventions, built-in update mechanisms, and disk serial number authentication in some variants to bind specific instances to specific victims. The tools are not individually more sophisticated than those used by other Chinese APT groups, but they are maintained with the discipline of a software engineering team rather than a one-off hack. FireEye's characterization of the development framework as "coherent" and "sustained" is the key insight — this is product development, not improvisation.

• BACKSPACE (Lecna): APT30's primary backdoor, in continuous development since at least 2005. Two main code branches documented: "ZJ" and "ZR," each compiled with slightly different command sets. Implemented as a standalone EXE, as a DLL, or as an EXE that extracts and launches a DLL at runtime. Persistence via Startup folder shortcuts, service DLL installation, or Registry Run keys depending on variant. Communicates with C2 via HTTP, including the distinctive "dizhi.gif" URL pattern. Supports file upload and download, remote command execution, process management, and registry manipulation. Built-in version check allows the backdoor to update itself to the latest version from C2 infrastructure automatically. The BACKSPACE controller GUI is a full-featured Windows application that tracks victim hostname, internal and external IP addresses, system uptime, OS version, and language — with menus for System, Network, File, Remote, and Attack operations. The controller includes a login prompt for the current "attendant," indicating shift-based operation.
• NETEAGLE (NetEagle Remote Control System): A second, complementary backdoor with samples compiled from 2008 to 2013. Two main versions: "Scout" (older) and "Norton" (newer). Different programming language and command set from BACKSPACE but shares high-level design similarities including C2 update features and two-stage C2 architecture. The "Norton" variant is named to resemble legitimate Norton security software. Supports loading DLL plugin components for extensibility. Internal strings updated post-2015 (NetEagle → JokerPlay) to evade published detection signatures.
• SHIPSHAPE: The first component of APT30's air-gap bridging chain. Runs on internet-connected machines with access to removable drives. Detects inserted removable drives, hides original files and folders on the drive by setting the hidden attribute, plants SPACESHIP executables on the drive named after the original hidden files — ensuring victims see apparently legitimate documents and open them, triggering SPACESHIP execution on air-gapped hosts. Persistence on the infected drive established via a shortcut in the drive's Startup folder.
• SPACESHIP: The payload deployed to air-gapped hosts via infected removable drives. When a victim on an air-gapped machine opens what appears to be a legitimate document (but is actually a SPACESHIP executable), SPACESHIP installs itself and begins collecting files based on a specified set of file extensions, staging the collected data to a hidden directory on the drive for later exfiltration. Uses consistent mutex naming (MicrosoftShipTrZJ) and encoding schemes shared with other APT30 tools.
• FLASHFLOOD: The exfiltration component of the air-gap chain, running on internet-connected machines. When a removable drive previously processed by SPACESHIP on an air-gapped host is reinserted into an internet-connected machine, FLASHFLOOD retrieves the staged data from the drive's hidden directory and passes it to the BACKSPACE controller for exfiltration over the internet. FLASHFLOOD also has system information collection capability independent of the air-gap chain.
• MILKMAID / ORANGEADE: Dropper tools used to deploy APT30's primary backdoors onto target systems after initial phishing exploitation. Used as the initial-stage payload from phishing documents to download and execute BACKSPACE or NETEAGLE.
• CREAMSICLE / BACKBEND / GEMCUTTER: Downloader tools used to pull additional payloads or updated backdoor versions from C2 infrastructure. Part of the broader supporting toolkit that manages the deployment lifecycle of APT30's primary tools.

Indicators of Compromise

The following IOCs are drawn from FireEye's April 2015 APT30 report, Kaspersky's 2019 follow-on analysis, and Positive Technologies' 2019 research. APT30 has modified some internal strings in response to public exposure (NetEagle → JokerPlay) but has demonstrated continued reuse of some long-standing infrastructure.

Mitigation & Defense

APT30 is assessed as active, with post-2019 activity confirmed in Southeast Asian targets. The group's targeting of ASEAN member state governments, India, and regional media makes it a priority threat for organizations in Southeast Asia and South Asia, as well as any Western organization with diplomatic, military, or journalistic engagement in the region. The air-gap crossing capability requires specific defensive consideration that most organizations' standard security stacks do not address.

• Removable Drive Controls — Air-Gap Defense: APT30's SHIPSHAPE/SPACESHIP/FLASHFLOOD chain relies entirely on humans physically carrying infected drives between systems. The most effective countermeasure is organizational: strictly control which removable drives are permitted in sensitive environments, implement drive scanning at the entry point to any air-gapped network, disable AutoRun and AutoPlay on all Windows endpoints, and use dedicated, purpose-registered USB drives with hardware write-protection for any legitimate data transfers into or out of air-gapped networks. Cryptographic signing of permitted files on authorized drives can detect SPACESHIP's file replacement technique.
• Spear-Phishing Defense for Regional Topics: APT30's lures are specifically crafted around the target's professional work — ASEAN summit documents, South China Sea policy papers, India-China military topics, and journalism relating to China. Standard phishing awareness training that focuses on generic "too good to be true" lures will not prepare targets for this group's sophisticated, contextually accurate lures. Train high-risk personnel (government officials, defense analysts, journalists covering China) to verify unexpected documents through out-of-band channels before opening, regardless of how relevant the lure content appears.
• HTTP Traffic Inspection for C2 Patterns: BACKSPACE's distinctive "dizhi.gif" URL pattern in stage-one C2 HTTP requests is a durable behavioral indicator. Implement network monitoring rules that flag HTTP requests to newly-registered or low-reputation domains containing this specific URI pattern. The two-stage C2 architecture means victims communicate with intermediate C2 servers before any interactive operator involvement — the stage-one traffic is more predictable and detectable than the interactive stage-two sessions.
• Mutex-Based Endpoint Detection: APT30's consistent mutex naming conventions — particularly the "MicrosoftZj," "MicrosoftShip," "MicrosoftShipTr," and "MicrosoftFlash" prefix patterns — are durable behavioral signatures that survive tool rotation as long as the underlying code architecture is maintained. EDR rules detecting mutex creation matching these patterns should be deployed and maintained even as specific file hashes and domains change.
• DNS Domain Monitoring: APT30 registers its own C2 domains and has reused some infrastructure for years. Implement continuous monitoring of DNS resolutions from endpoints to newly registered or newly-resolved domains, particularly those with ASEAN, Southeast Asian, or China-adjacent naming themes. The group's reuse of some long-standing domains means historical domain blocklists have non-zero value — but should be supplemented with behavioral detection for new infrastructure.
• Journalist and Media Organization Security: APT30 specifically targets journalists covering China and Southeast Asia. Media organizations should implement security measures commensurate with the nation-state threat they face: encrypted communications for sensitive correspondence, source protection training that accounts for the possibility of inbox compromise, and endpoint monitoring that would detect BACKSPACE's startup persistence mechanisms and C2 communication patterns.
• Long-Dwell Detection: APT30's decade of continuous operations demonstrates a willingness to maintain access and wait for relevant intelligence opportunities rather than execute noisy bulk exfiltration. Standard detection approaches focused on high-volume or high-velocity indicators will miss an actor that may sit dormant for weeks or months waiting for the right document or summit preparation material. Implement anomaly-based detection that baselines normal endpoint behavior over long time windows and flags low-frequency but anomalous events like new service installations, unusual startup entries, or rare outbound HTTP connections.

Sources & Further Reading

Attribution and references used to build this profile.

• MITRE ATT&CK — Group G0013: APT30
• Mandiant (Google Cloud) — APT30 and the Mechanics of a Long-Running Cyber Espionage Operation (April 2015)
• Positive Technologies — The Eagle Eye Is Back: Old and New Backdoors from APT30 (2019)
• Kaspersky — APT30 Report PDF (2015)
• SecureWorks — Bronze Geneva Threat Profile (APT30 / Override Panda)
• Council on Foreign Relations — Cyber Operations Tracker: APT 30
• MITRE ATT&CK — Software S0028: SHIPSHAPE
• Microsoft MSTIC — Threat Actor Naming Mapping (Raspberry Typhoon / RADIUM = APT30)
• CyberMaterial — APT30 / Override Panda Profile