SAMURAI PANDA
Also known as PLA Navy, Wisp Team, APT18, TG-0416, Dynamite Panda, Threat Group-0416
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. (Citation: Dell Lateral Movement)
Targets: Private sector, Military, United States, United Kingdom, Hong Kong
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1027.013 Encrypted/Encoded FileT1053.002 AtT1059.003 Windows Command ShellT1070.004 File DeletionT1071.001 Web ProtocolsT1071.004 DNST1078 Valid AccountsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1105 Ingress Tool TransferT1133 External Remote ServicesT1547.001 Registry Run Keys / Startup Folder
Recent activity
No posts or advisories have named this actor recently.
References
- http://www.crowdstrike.com/blog/whois-samurai-panda/
- http://www.secureworks.com/resources/blog/where-you-at-indicators-of-lateral-movement-using-at-exe-on-windows-7-systems/
- https://attack.mitre.org/groups/G0026
- https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop
- https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.