Tonto Team is a threat actor attributed to CN, also known as BRONZE HUNTLEY, TAG-74, PLA Unit 65017. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Tonto Team exploit?

Tonto Team is known to exploit 10 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Tonto Team

Also known as: BRONZE HUNTLEY, TAG-74, PLA Unit 65017, G0131, KARMA PANDA, CactusPete, COPPER, Red Beifang, Karma Panda, Earth Akhlut

Exploited CVEs

Overview

Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malware, including the Bisonal RAT and ShadowPad. They employ spear-phishing emails with malicious attachments as their preferred method of distribution.

Exploited Vulnerabilities

CVE ID	Action
CVE-2018-8174	View Details