APT Explorer

All actors

WET PANDA

Also reported as Red Chimera and Wet Panda. Linked to China by three sources.

Reports
66
Last reported
Known CVEs
46
Origin
China
ID
wet-panda
Sources
MISPETDAMalpedia
Merge evidence
3 alias matches

Reports per quarter

Dated reports, 2013 Q4 to 2026 Q3.

Techniques seen in the last two years

Show all 20 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

Show all 46 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. SilkParasite: Tracking a China-Nexus APT Across Central Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. новый модульный бэкдор в госсекторе — Анализ Solar 4RAYS

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. Operation FishMedley targeting governments, NGOs, and think tanks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. Updated Shadowpad Malware Leads to Ransomware Deployment

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Meet NailaoLocker: a ransomware distributed in Europe by ShadowPad and PlugX backdoors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. Updated Shadowpad Malware Leads to Ransomware Deployment

    Malpedia library date ORKL

    Archived copy on ORKL Details

Show all 66 reports Show fewer

  1. ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. JSAC2025_1_5_leon-chang_theo-chen_en.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. APT41 likely compromised Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. Malware Transmutation! - Unveiling the Hidden Traces of BloodAlchemy

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. Anxun and Chinese APT Activity

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. Inside The Lab - HarfangLab

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. Tracking ShadowPad Infrastructure Via Non-Standard Certificates

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. 2023 Adversary Infrastructure Report

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. Possible supply chain attack targeting South Asian government delivers Shadowpad

    Malpedia library date ORKL

    Archived copy on ORKL Details

  11. Slides-Possible-supply-chain-attack-targeting-South-Asian-government-delivers-Shadowpad.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  12. Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda

    Malpedia library date ORKL

    Archived copy on ORKL Details

  13. Redfly: Espionage Actors Continue to Target Critical Infrastructure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  14. RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale

    Malpedia library date ORKL

    Archived copy on ORKL Details

  15. Possible Supply Chain Attack Targeting Pakistani Government Delivers Shadowpad

    Malpedia library date ORKL

    Archived copy on ORKL Details

  16. Lancefly: Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors

    Malpedia library date ORKL

    Archived copy on ORKL Details

  17. Update to the REF2924 intrusion set and related campaigns

    Malpedia library date ORKL

    Archived copy on ORKL Details

  18. Threat Analysis: Active C2 Discovery Using Protocol Emulation Part3 (ShadowPad)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  19. VB2022-Tracking-the-entire-iceberg.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  20. Cyber Security Research

    Malpedia library date ORKL

    Archived copy on ORKL Details

  21. Tracking the entire iceberg – long‑term APT malware C2 protocol emulation and scanning

    Malpedia library date Virus Bulletin ORKLCCS '25 data

    Archived copy on ORKL Details

  22. New Wave of Espionage Activity Targets Asian Governments

    Malpedia library date ORKL

    Archived copy on ORKL Details

  23. Worok: The big picture

    Malpedia library date ORKL

    Archived copy on ORKL Details

  24. Attacks on industrial control systems using ShadowPad | Kaspersky ICS CERT EN

    Malpedia library date ORKL

    Archived copy on ORKL Details

  25. Space Pirates: analyzing the tools and connections of a new hacker group

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  26. AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  27. Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad

    Malpedia library date ORKL

    Archived copy on ORKL Details

  28. China accused of cyberattacks on Indian power grid

    Malpedia library date ORKL

    Archived copy on ORKL Details

  29. 2021%20ICS%20OT%20Cybersecurity%20Year%20In%20Review%20-%20Dragos%202021.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  30. Researchers Link ShadowPad Malware Attacks to Chinese Ministry and PLA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  31. Microsoft Word - FLASH TLP WHITE CVE Zoho Desktop Servers v1.4 Updated template

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  32. Winnti is Coming - Evolution after Prosecution@HITCON2021

    Malpedia library date ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  33. Chasing Shadows: A deep dive into the latest obfuscation methods being used by ShadowPad

    Malpedia library date ORKL

    Archived copy on ORKL Details

  34. It’s a BEE! It’s a… no, it’s ShadowPad.

    Malpedia library date ORKL

    Archived copy on ORKL Details

  35. Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

    Malpedia library date Kaspersky ORKLCCS '25 data

    Archived copy on ORKL Details

  36. D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  37. ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage - SentinelLabs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  38. Презентация PowerPoint

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  39. the-operations-of-winnti-group.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  40. RedEcho group parks domains after public exposure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  41. China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions

    Malpedia library date ORKL

    Archived copy on ORKL Details

  42. Report2021GTR.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  43. Higaisa or Winnti? APT41 backdoors, old and new

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  44. Operation StealthyTrident: corporate software under attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  45. APT trends report Q3 2020

    Malpedia library date ORKL

    Archived copy on ORKL Details

  46. winnti-2020-rus.pdf

    file creation date ORKL

    The original link failed its last check. Original publisher Details

  47. APT41: Indictments Put Chinese Espionage Group in the Spotlight

    Malpedia library date Symantec ORKLCCS '25 data

    Archived copy on ORKL Details

  48. APT trends report Q2 2020

    Malpedia library date ORKL

    Archived copy on ORKL Details

  49. The Manufacturing Threat Landscape in 2020 | CrowdStrike

    Malpedia library date ORKL

    Archived copy on ORKL Details

  50. BackDoor.ShadowPad.1 — Dr.Web Malware description library

    Malpedia library date ORKL

    Archived copy on ORKL Details

  51. Cyber Threats 2019: A Year in Retrospect

    Malpedia library date ORKL

    Archived copy on ORKL Details

  52. Winnti Group targeting universities in Hong Kong

    Malpedia library date ORKL

    Archived copy on ORKL Details

  53. Operation ShadowHammer: a high-profile supply chain attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  54. C/C++ Runtime Library Code Tampering in Supply Chain

    Malpedia library date ORKL

    Archived copy on ORKL Details

  55. ShadowPad in corporate networks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  56. CrowdCasts Monthly: You Have an Adversary Problem

    Malpedia library date ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

Newest first. Details opens the report in Explore.