🇨🇳

Yanbian Gang

APT Group ETDA ✓

Also Known As

No alias recorded

Target Countries 12

Countries highlighted in red

Switzerland Germany France United Kingdom Israel India Japan Republic of Korea Kuwait Singapore Province of China Taiwan United States

Sectors Targeted

No targeted sector recorded

Details

Origin 🇨🇳 CN

Last Updated 13 Apr 2026

MITRE ATT&CK 4

T1027 T1071.001 T1105 T1543.003

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

Yanbian Gang ?

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

South Korea

Description

(Trend Micro) In 2014, we took a close look at the Chinese underground market and found that it continued to thrive. But what we did not see was that even cybercriminals in remote parts of the country—Yanbian—were successfully profiting from the Android™ mobile banking customers in a neighboring country—South Korea. What we have dubbed the “Yanbian Gang” has successfully been siphoning millions from their victims’ accounts since 2013. The hackers used fake banking and other popular apps to victimize more than 4,000 South Korean Android mobile banking customers throughout 2013 and 2014. They also used effective social engineering lures like “The Interview” to bait victims into installing their fake apps.

Operations 1

2020-12 Yanbian Gang Malware Continues with Wide-Scale Distribution and C2 https://www.riskiq.com/blog/external-threat-management/yanbian-gang-malware-distribution/

Reports & References 1

https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-the-south-korean-fake-banking-app-scam.pdf

ETDA Profile

Yanbian Gang

Origin

China

First Seen 2013

Motivation

Financial crime

View on ETDA APT Groups ↗