Houndstooth Typhoon
HASSIUMDRAGNET PANDAisoon
Microsoft threat actor profile. Origin/Threat: China.
origin (suspected)
China
source: misp-galaxy1 refs →
Houndstooth Typhoon· China
China-linked Houndstooth Typhoon is known for data theft and custom backdoors targeting government and critical infrastructure sectors.
Analyst brief
Houndstooth Typhoon (also tracked as HASSIUM, DRAGNET PANDA) is a threat actor of likely Chinese origin, profiled by Microsoft. It primarily targets government entities, critical infrastructure, and telecommunications sectors. The actor employs custom tooling and backdoors for data theft, often repurposing open-source tools within its TTPs. Defenders should monitor for anomalous network traffic and suspicious PowerShell execution, especially signs of compromised credential usage.
unknown
FAQ2
Which sectors does Houndstooth Typhoon primarily target?
Houndstooth Typhoon primarily targets government entities, critical infrastructure, and telecommunications sectors.
What signs should defenders monitor to detect Houndstooth Typhoon activity?
Defenders should monitor for anomalous network traffic, suspicious PowerShell execution, and especially signs of compromised credential usage.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.