POISONUS PANDA
origin (suspected)
Chinaattribution confidence: medium (50)
source: misp-galaxy1 refs →
POISONUS PANDA· China
POISONUS PANDA is a mysterious, likely Chinese-origin threat actor conducting long-term espionage against high-intelligence-value targets in the Asia-Pacific.
Analyst brief
POISONUS PANDA is an enigmatic threat actor group, likely of Chinese origin. They primarily target organizations of high intelligence value within the Asia-Pacific region. This group's TTPs include custom-developed malware, targeted phishing campaigns, and covert C2 channels for long-term espionage. Defenders must apply heightened monitoring for suspicious emails primarily from Eastern regions, anomalous DNS queries, and privilege escalation attempts.
unknown
FAQ2
Which geographical region does POISONUS PANDA primarily target?
POISONUS PANDA primarily targets organizations within the Asia-Pacific region.
What activities should defenders apply heightened monitoring for against POISONUS PANDA's TTPs?
Defenders must apply heightened monitoring for suspicious emails primarily from Eastern regions, anomalous DNS queries, and privilege escalation attempts.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.