🇨🇳

Dalbit

APT Group Information theft and espionage 2 zero-day CVEs ETDA ✓

Also Known As

No alias recorded

Target Countries 1

Countries highlighted in red

Republic of Korea

Sectors Targeted

Hospitality Shipping and Logistics Construction Maritime and Shipbuilding Energy Consulting companies Chemical Education High-Tech Automotive Industrial Food and Agriculture Media Computer Systems Design and Related Services 54151 Technology

Details

Origin 🇨🇳 CN

Last Updated 13 Apr 2026

MITRE ATT&CK 19

T1016 T1059.001 T1070 T1071.001 T1078 T1090 - Proxy T1110.002 T1134.001 T1140 T1566.001 T1573 T1574 TA0002 TA0005 TA0006 TA0007 TA0011 TA0034 TA0040

Related Zero-Days 2

CVE-2020-0796 CVE-2024-4885

Known Names 1 entries

Dalbit AhnLab

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

South Korea

Description

(AhnLab) This group has had more than 50 confirmed attack attempts on Korean companies since 2022. Most of the attacked companies were mid to small companies while a portion was major companies. The team has confirmed that 30% of the infected companies were using a certain Korean groupware solution. It is currently difficult to check whether this groupware product has a vulnerability or not, but if a server that is this exposed has a vulnerability, then there is a chance that companies could be affected gravely through the leakage of confidential information and ransomware behavior. Furthermore, this Dalbit group leaves some infected companies as proxies and download servers to later use them as means to communicate with the threat actor upon infiltration of another company.

Tools Used 21

AntSword ASPXSpy BadPotato BlueShell China Chopper Cobalt Strike EFSPotato FRP Godzilla HTran JuicyPotato LadonGo Metasploit Mimikatz NPS ProcDump PsExec reGeorg Remcom RottenPotato SweetPotato

Reports & References 1

https://asec.ahnlab.com/en/47455/

ETDA Profile

Dalbit

Origin

China

First Seen 2022

Motivation

Information theft and espionage

View on ETDA APT Groups ↗