Home › Threat Actors › APT40 (Kryptonite Panda / TEMP.Periscope)
← All Threat Actors
Nation-State high China (Hainan, People's Republic of China)

APT40 (Kryptonite Panda / TEMP.Periscope)

China — a July 2024 joint CISA/FBI/ASD/NCSC advisory (AA24-190A) attributed the group to the Hainan State Security Bureau, a provincial office of China's Ministry of State Security (MSS), operating via front company Hainan Xiandun Technology Development Co., Ltd. · State-directed espionage focused on maritime/naval intelligence and regional Indo-Pacific influence

Reports 1
Active Since 2013
Last Reported 6 Aug 2026
Sectors Targeted defense, maritime, academia, government, telecommunications

Tactics, Techniques & Procedures (TTPs)

  • Rapid, often same-day-to-days exploitation of newly disclosed CVEs in internet-facing software (Microsoft Exchange, Atlassian Confluence, Apache Log4j, VPN/firewall/remote-access gateways)
  • Initial access primarily via internet-facing services/public-facing application exploitation rather than spearphishing
  • AIRBREAK: JavaScript backdoor using compromised third-party/legitimate content-sharing sites as C2
  • FRESHFIRE: .NET dropper for secondary payloads, persistence via scheduled tasks/registry modification
  • LOWBALL: Dropbox-API-based C2 backdoor abusing trusted cloud storage traffic
  • Web shells on Exchange/Confluence/WordPress as durable re-entry points
  • Living-off-the-land tooling (certutil, bitsadmin, mshta, regsvr32) and modified Cobalt Strike/open-source red-team frameworks
  • Supply-chain pivoting via MSPs and software vendors to reach actual intelligence targets

Known Targets

Naval/maritime technology: shipbuilding contractors, naval research institutions, marine propulsion/sonar manufacturers, undersea-systems defence companiesAcademic/research institutions with marine science, oceanography, or naval architecture programs (US, Australia, Europe)Pacific Island national governments (disproportionately targeted relative to size)Regional Asia-Pacific telecommunications providers/backbone infrastructureEnergy companies with South China Sea / Indo-Pacific offshore exposureEmerging: AI research and semiconductor supply-chain organisations (2025-2026 reporting)

Analyst Notes

Article emphasizes APT40's defining operational trait — exploiting newly disclosed CVEs faster than typical enterprise patch cycles. A 2021 DOJ indictment named four Chinese nationals (incl. Wu Shurong) tied to the Hainan SSB's Technical Reconnaissance Bureau. Dwell time historically long (months). The group is frequently observed in networks alongside other Chinese state actors (e.g., APT41) without apparent coordination.

Also Known As

Kryptonite PandaTEMP.PeriscopeLeviathanBronze MohawkGADOLINIUMSilk TyphoonTA423 (partial overlap)Red Ladon (partial overlap)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1505.003 Server Software Component: Web Shell T1102 Web Service T1059.001 Command and Scripting Interpreter: PowerShell T1218 System Binary Proxy Execution

Intelligence Reports

Analysis defensemaritime

APT40: China's Maritime Espionage Machine and Its Playbook for 2026

APT40 — also tracked as Kryptonite Panda, TEMP.Periscope, and Bronze Mohawk — has operated as China's principal cyber instrument for maritime and naval intelligence collection for over a decade. A joint CISA-FBI-ASD-NCSC advisory confirmed ties to Hainan's State Security Bureau. Here's what the group does, how it works, and why its rapid CVE exploitation model is more relevant than ever.

6 Aug 2026 · 14 min read