Tonto Team
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
Tonto Team is a Chinese-speaking APT group that has been active since at least 2013. They primarily target military, diplomatic, and infrastructure organizations in Asia and Eastern Europe. The group has been observed using various malware, including the Bisonal RAT and ShadowPad. They employ spear-phishing emails with malicious attachments as their preferred method of distribution.
Source-reported aliases: CactusPete, KARMA PANDA, BRONZE HUNTLEY, COPPER, Red Beifang, G0131, PLA Unit 65017, Earth Akhlut, TAG-74, LONE CASTLE. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
Japan · 
South Korea · 
Taiwan · 
United States of America
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/
https://www.wsj.com/articles/chinas-secret-weapon-in-south-korea-missile-fight-hackers-1492766403
https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf
https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/
https://go.recordedfuture.com/hubfs/reports/cta-2023-0919.pdf
https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/