Type: Nation-State-Sponsored

APT12 Status: Believed Inactive

APT12 Other Names: Numbered Panda/ IXESHE/ DYNCALC/ JOY RAT/ Etumbot/ Beebus/ Group 22/ TG-2754/ Calc Team/ DynCalc/ Crimson Iron/ DNSCalc

Active Since/Discovered: 10/2012 – 5/2014

Target Sectors: media outlets, high-tech companies, and government organizations


  • Etumbot
  • Riptide
    • RIPTIDE is a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control (C2) server
  • Hightide
  • ThreeByte, backdoor
  • Waterspout, backdoor
    • all variants of same backdoor, differ to avoid detection
    • enable persist presence and surveillance
  • Mswab
  • Gh0st
  • ShowNews
  • 3001

Preferred Attack Vector:  Spear phishing


  • binary exes disguised as screensavers and PDFs
  • exploit CVE-2012-0158

Unique: Changes tools after public exposure

Privacy Settings
We use cookies to enhance your experience while using our website. If you are using our Services via a browser you can restrict, block or remove cookies through your web browser settings. We also use content and scripts from third parties that may use tracking technologies. You can selectively provide your consent below to allow such third party embeds. For complete information about the cookies we use, data we collect and how we process them, please check our Privacy Policy
Consent to display content from Youtube
Consent to display content from Vimeo
Google Maps
Consent to display content from Google