Putter Panda
Also reported as APT2, MSUpdater, TG-6952, SearchFire, 4HCrew and 6 other names. Linked to China by three sources.
Reports per quarter
Techniques in ATT&CK
Listed by ATT&CK
No report from the last two years names a technique ID.
CVEs named in reports
- CVE-2009-3129 KEV
- CVE-2010-0232 KEV
- CVE-2010-2572 KEV
- CVE-2010-2883 KEV
- CVE-2010-3333 KEV
- CVE-2010-4398 KEV
- CVE-2011-3402 KEV
- CVE-2012-0158 KEV ransomware
- CVE-2012-4792 KEV
- CVE-2012-4969 KEV
- CVE-2014-0160 KEV
- CVE-2014-0322 KEV
Show all 25 CVEs Show fewer
- CVE-2014-1761 KEV
- CVE-2014-1776 KEV
- CVE-2014-4113 KEV
- CVE-2014-6271 KEV
- CVE-2014-6277
- CVE-2014-6278 KEV
- CVE-2014-7169 KEV
- CVE-2014-7186
- CVE-2014-7187
- CVE-2015-2360 KEV
- CVE-2015-5119 KEV
- CVE-2016-4171 KEV
- CVE-2018-0802 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor PLA Unit 61486
-
Scarlet Mimic - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Scarlet Mimic - Threat Group Cards: A Threat Actor Encyclopedia
-
Malware-Free Intrusions: Adversary Tricks and CrowdStrike Treats »
The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Malware-Free Intrusions: Adversary Tricks and CrowdStrike Treats »
-
ICIT Brief – China’s Espionage Dynasty: Economic Death by a Thousand Cuts
The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor ICIT Brief – China’s Espionage Dynasty: Economic Death by a Thousand Cuts
-
What is going on with Lapsus$-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor What is going on with Lapsus$-
Show all 37 reports Show fewer
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor LazyScripter
-
Auf Tätersuche- Herausforderungen bei der Analyse von Cyber-Angriffen
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Auf Tätersuche- Herausforderungen bei der Analyse von Cyber-Angriffen
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor T1055 Process Injection
-
Reviving MuddyC3 Used by MuddyWater (IRAN) APT
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Reviving MuddyC3 Used by MuddyWater (IRAN) APT
-
cds19-executive-s08-achievement-unlocked.pdf
The original link failed its last check. Original publisher Detailsfor cds19-executive-s08-achievement-unlocked.pdf
-
Calypso APT: new group attacking state institutions
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Calypso APT: new group attacking state institutions
-
The original link failed its last check. Original publisher Detailsfor calypso-apt-2019-rus.pdf
-
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Two Birds, One STONE PANDA
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Two Birds, One STONE PANDA
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Two Birds, One STONE PANDA
-
CS_organisation_CHINA_092016 (1)
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CS_organisation_CHINA_092016 (1)
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ProjectSauron_ top level cyber-espionage platform covertly extracts encrypted government comms - Securelist
-
ICIT-Brief-China-Espionage-Dynasty
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ICIT-Brief-China-Espionage-Dynasty
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor PowerPoint Presentation
-
Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Know Your Enemies 2.0: A Primer on Advanced Persistent Threat Groups
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists - Palo Alto Networks BlogPalo Alto Networks Blog
-
The link to Mirror on Box failed its last check. Mirror on Box Detailsfor Scarlet Mimic
-
Scarlet Mimic- Years-Long Espionage Campaign Targets Minority Activists
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Scarlet Mimic- Years-Long Espionage Campaign Targets Minority Activists
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Global Threat Intel Report
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Putter Panda
-
CrowdCasts Monthly: You Have an Adversary Problem
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor CrowdCasts Monthly: You Have an Adversary Problem
-
Microsoft Word - MSUpdater Trojan Whitepaper [MG4].docx
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft Word - MSUpdater Trojan Whitepaper [MG4].docx
Newest first. Details opens the report in Explore.