File · APT2 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
APT2
- PLA Unit 61486
- PUTTER PANDA
- MSUpdater
- 4HCrew
- SULPHUR
- SearchFire
- TG-6952
- G0024
state sponsor · ChinaMITRE G0024 ↗
attack rose · 4 techniques across 3 tactics
Analyst brief
misp-galaxy + mitre-attackPutter Panda were the subject of an extensive report by CrowdStrike, which stated: 'The CrowdStrike Intelligence team has been tracking this particular unit since2012, under the codename PUTTER PANDA, and has documented activity dating back to 2007. The report identifies Chen Ping, aka cpyy, and the primary location of Unit 61486.'
Observed targets (as stated by the sources)
0 countries · 2 sectorsassessed origin · Chinaobserved targets · 0
sectors · 2
- Private sector
- Government
also stated: U.S. satellite and aerospace sector
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique4 techniques · 3 of 15 tactics
Persistence
1 techniqueStealth
2 techniquesDefense impairment
1 technique
select a technique
Arsenal
4 malwareas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
6 sources- 1.cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-…
- 2.cfr.org/interactive/cyber-operations/putter-panda
- 3.attack.mitre.org/groups/G0024
- 4.mandiant.com/resources/insights/apt-groups
- 5.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/…
- 6.blogs.blackberry.com/en/2016/01/puttering-into-the-future
Track APT2 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.