Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT24 · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

APT24

  • PITTY PANDA
  • G0011
  • Temp.Pittytiger

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2014-1761

Analyst brief

misp-galaxy

The Pitty Tiger group has been active since at least 2011. They have been seen using HeartBleed vulnerability in order to directly get valid credentials

CVEs APT24 is cited as exploiting

none on KEV
  1. CVE-2014-17612026-10-17
    1. “the actor has proven to be one of the early groups that are able to successfully weaponize documents with an exploit for CVe-2014-1761”

      cited as exploiting · named nearby · source: go.crowdstrike.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

7 sources
  1. 1.blog.airbuscybersecurity.com/post/2014/07/The-Eye-of-the-Tiger2
  2. 2.blog.cassidiancybersecurity.com/post/2014/07/The-Eye-of-the-Tiger2
  3. 3.paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.07.11.…
  4. 4.securingtomorrow.mcafee.com/other-blogs/mcafee-labs/targeted-attacks-on-french-com…
  5. 5.fireeye.com/blog/threat-research/2014/07/spy-of-the-tiger.html
  6. 6.attack.mitre.org/groups/G0011
  7. 7.mandiant.com/resources/insights/apt-groups

Track APT24 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.