Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
Also known as: Tonto Team, HeartBeat, Karma Panda, CactusPete, Bronze Huntley, Earth Akhlut, LoneRanger, TAG-74, G0131, KARMA PANDA, BRONZE HUNTLEY, COPPER, Red Beifang, PLA Unit 65017
The first HeartBeat campaign remote access tool (RAT) component was discovered in June 2012 in a Korean newspaper company network. Further investigation revealed that the campaign has been actively distributing their RAT component to their targets in 2011 and the first half of 2012. Furthermore, we uncovered one malware component that dates back to November 2009. This indicates that the campaign started during that time or earlier. The HeartBeat campaign appears to target government organizations and institutions or communities that are in some way related to the South Korean government. Specifically, we were able to identify the following targets: • Political parties • Media outfits • A national policy research institute • A military branch of South Korean armed forces • A small business sector organization • Branches of South Korean government The profile of their targets suggests that the motive behind the campaign may be politically motivated. ( Kaspersky ) The actor has quite likely relied on much the same codebase and implant variants for the past six years. However these have broadened substantially since 2018. The group spear-phishes its targets, deploys Word and Equation Editor exploits and an appropriated/repackaged DarkHotel VBScript zero-day, delivers modified and compiled unique Mimikatz variants, GSEC and WCE credential stealers, a keylogger, various Escalation of Privilege exploits, various older utilities and an updated set of backdoors, and what appear to be new variants of custom downloader and backdoor modules.
No exploited CVEs have been attributed to this threat actor yet.