# GTG-1002

> As of 2026-10-29, GTG-1002 is a China-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning threat intel, campaign. ATT&CK coverage spans 47 techniques across 14 tactics in 2 of 2 tracked threats. Most-observed techniques: T1005 (Data from Local System), T1046 (Network Service Discovery), T1078 (Valid Accounts).

- **Nation:** China
- **Tracked threats:** 2
- **Categories:** THREAT_INTEL, CAMPAIGN
- **As of:** 2026-10-29

## ATT&CK techniques observed

47 techniques observed across 2 of 2 tracked threats. Tactics: Stealth (formerly Defense Evasion) (7), Credential Access (5), Discovery (5), Command and Control (4), Resource Development (4), Execution (3).

- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 2 of 2 tracked threats
- [T1046](https://intel.threadlinqs.com/technique/T1046) Network Service Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 2 of 2 tracked threats
- [AML.T0054](https://intel.threadlinqs.com/technique/AML.T0054) LLM Jailbreak — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1003](https://intel.threadlinqs.com/technique/T1003) OS Credential Dumping — Credential Access — observed in 1 of 2 tracked threats
- [T1014](https://intel.threadlinqs.com/technique/T1014) Rootkit — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1021](https://intel.threadlinqs.com/technique/T1021) Remote Services — Lateral Movement — observed in 1 of 2 tracked threats
- [T1021.004](https://intel.threadlinqs.com/technique/T1021.004) Remote Services: SSH — Lateral Movement — observed in 1 of 2 tracked threats
- [T1036.005](https://intel.threadlinqs.com/technique/T1036.005) Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1053.003](https://intel.threadlinqs.com/technique/T1053.003) Cron — Persistence — observed in 1 of 2 tracked threats
- [T1057](https://intel.threadlinqs.com/technique/T1057) Process Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 1 of 2 tracked threats
- [T1059.004](https://intel.threadlinqs.com/technique/T1059.004) Unix Shell — Execution — observed in 1 of 2 tracked threats
- [T1068](https://intel.threadlinqs.com/technique/T1068) Exploitation for Privilege Escalation — Privilege Escalation — observed in 1 of 2 tracked threats
- [T1070.006](https://intel.threadlinqs.com/technique/T1070.006) Timestomp — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats

## Tracked threats

- [Cisco Open-Sources Quarry to Detect AI Agent Attacks Hidden in Individually Benign Steps (GTG-1002 and Mexican Government Claude Code Abuse Context)](https://intel.threadlinqs.com/threat/TL-2026-4747) — LOW
- [Check Point AI Security Report 2026: AI Shifts from Attack Tool to Autonomous Intrusion Operator (VoidLink C2, Mexico Government Breach, GTG-1002)](https://intel.threadlinqs.com/threat/TL-2026-1286) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/GTG-1002