APT2
Also known as PLA Unit 61486, PUTTER PANDA, MSUpdater, 4HCrew, SULPHUR, SearchFire, TG-6952, G0024
Putter Panda were the subject of an extensive report by CrowdStrike, which stated: 'The CrowdStrike Intelligence team has been tracking this particular unit since2012, under the codename PUTTER PANDA, and has documented activity dating back to 2007. The report identifies Chen Ping, aka cpyy, and the primary location of Unit 61486.'
Targets: Private sector, Government, U.S. satellite and aerospace sector
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
Recent activity
No posts or advisories have named this actor recently.
References
- http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf
- https://www.cfr.org/interactive/cyber-operations/putter-panda
- https://attack.mitre.org/groups/G0024
- https://www.mandiant.com/resources/insights/apt-groups
- https://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf
- https://blogs.blackberry.com/en/2016/01/puttering-into-the-future
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.