Introduction
Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). CrowdStrike Putter Panda
Activities and Tactics
Targeted Sectors: Private sector, Government
Country of Origin: 🇨🇳 China
Incident Type: Espionage
Suspected Victims: U.S. satellite and aerospace sector
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1547.001 Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools
- T1055.001 Dynamic-link Library Injection
- T1027.013 Encrypted/Encoded File
ATT&CK technique IDs (denormalized)
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- pngdowner (S0067) — malware
- 3PARA RAT (S0066) — malware
- 4H RAT (S0065) — malware
- httpclient (S0068) — malware
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
[1] mitre-attack [5] CrowdStrike Putter Panda Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016. [6] Cylance Putter Panda Gross, J. and Walter, J.. (2016, January 12). Puttering into the Future…. Retrieved November 17, 2024.