A China-based nation-state threat actor known for spear-phishing and data exfiltration targeting military and private sector entities in the US, UK, and Hong Kong.
SAMURAI PANDA, also known as PLA Navy or Wisp Team, is a China-based nation-state threat actor. They primarily target private sector companies and military organizations in the United States, United Kingdom, and Hong Kong. Key TTPs include spear-phishing campaigns, custom malware deployment, and data exfiltration through persistent C2 channels. Defenders should prioritise strengthening email security solutions, monitoring for anomalous network traffic in military and private sector networks, and enforcing multi-factor authentication, especially on systems with Hong Kong connections.
SAMURAI PANDA Çin mənşəli APT-dır, ABŞ, Böyük Britaniya və Hong Kong-da private sector və military sahələrini hədəf alır.
They primarily target private sector companies and military organizations in the United States, United Kingdom, and Hong Kong.
Observed activities include spear-phishing campaigns, custom malware deployment, and data exfiltration through persistent C2 channels.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.