SABRE PANDA
origin (suspected)
Chinaattribution confidence: medium (50)
source: misp-galaxy1 refs →
SABRE PANDA primarily targets political, diplomatic, and defense entities within the Asia-Pacific region.
Defenders should enforce active monitoring for anomalous PowerShell execution, irregularities in web traffic, and suspicious domains in email origins.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.