APT9
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
APT9 engages in cyber operations where the goal is data theft, usually focusing on the data and projects that make a particular organization competitive within its field. APT9 was historically very active in the pharmaceuticals and biotechnology industry. We have observed this actor use spearphishing, valid accounts, as well as remote services for Initial Access. On at least one occasion, Mandiant observed APT9 at two companies in the biotechnology industry and suspect that APT9 actors may have gained initial access to one of the companies by using a trusted relationship between the two companies. APT9 use a wide range of backdoors, including publicly available backdoors, as well as backdoors that are believed to be custom, but are used by multiple APT groups.
Source-reported aliases: NIGHTSHADE PANDA, Red Pegasus, Group 27. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
United States of America
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://otx.alienvault.com/pulse/55bbc68e67db8c2d547ae393
https://www.mandiant.com/resources/insights/apt-groups
https://app.box.com/s/z1uanuv1vn3vw5iket1r6bqrmlra0gpn