File · GOBLIN PANDA · Nation-state · assessed origin China · misp-galaxy · refreshed 2026-10-06
GOBLIN PANDA
- Conimes
- Cycldek
state sponsor · Chinaattribution confidence 75/100 (source-stated)
sigil · no ATT&CK coverage stated
What changed
ledger · newest first- —todaynew CVE2 new CVEs: CVE-2012-0158, CVE-2017-11882
Analyst brief
misp-galaxyGoblin Panda is one of a handful of elite Chinese advanced persistent threat (APT) groups. Most Chinese APTs target the United States and NATO, but Goblin Panda focuses primarily on Southeast Asia.
Observed targets (as stated by the sources)
7 countries · 1 sectorsassessed origin · Chinaobserved targets · 7
countries · 7
- Malaysia
- India
- Indonesia
- Japan
- Philippines
- South Korea
- Vietnam
sectors · 1
- Private Sector
also stated: Southeast Asia
as stated by MISP galaxy / ransomware.live — not inferred
CVEs cited sources tie to GOBLIN PANDA
none on KEV- CVE-2017-118822026-10-17
“Distribution of infected samples are often used by attackers such as Goblin Panda through weaponized Microsoft Office documents containing malicious macros, or by exploiting known vulnerabilities—most recently CVE-2012-0158 and CVE-2017-11882.”
cited as exploiting · source: fortinet.com ↗ · 2026-10-17
- CVE-2012-01582026-10-17
“Distribution of infected samples are often used by attackers such as Goblin Panda through weaponized Microsoft Office documents containing malicious macros, or by exploiting known vulnerabilities—most recently CVE-2012-0158 and CVE-2017-11882.”
cited as exploiting · source: fortinet.com ↗ · 2026-10-17
“When opened, both documents use CVE-2012-0158 exploit code to drop malicious files associated with a previously identified side-loading malware implant, tracked as QCRat by CrowdStrike Falcon® Intelligence™.”
cited as used in a campaign · named nearby · source: crowdstrike.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Take it with you
keyless · no signupReferences
5 sources- 1.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-augu…
- 2.securelist.com/cycldek-bridging-the-air-gap/97157
- 3.fortinet.com/blog/threat-research/cta-security-playbook--goblin-pan…
- 4.go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThrea…
- 5.cyberthreat.thalesgroup.com/sites/default/files/2022-05/THALES%20THREAT%20HANDBOOK…
Track GOBLIN PANDA on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.