> For the complete documentation index, see [llms.txt](https://malfav.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malfav.gitbook.io/home/malware-introduction/advanced-persistence-threat-apt/apt-groups/tonto-team.md).

# Tonto Team

[Tonto Team](https://attack.mitre.org/groups/G0131) is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. [Tonto Team](https://attack.mitre.org/groups/G0131) has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).[\[1\]](https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/)[\[2\]](https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/)[\[3\]](https://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf)[\[4\]](https://arstechnica.com/information-technology/2017/04/researchers-claim-china-trying-to-hack-south-korea-missile-defense-efforts/)[\[5\]](https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the-heartbeat-apt-campaign.pdf?)[\[6\]](https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html)

<br>