SharpPanda

Also known as: Sharp Dragon, Sharp Dragon (CHKPT), Sharp Panda, SharpPanda

SharpPanda, an APT group originating from China, has seen a rise in its cyber-attack operations starting from at least 2018. The APT group utilizes spear-phishing techniques to obtain initial access, employing a combination of outdated Microsoft Office document vulnerabilities, novel evasion techniques, and highly potent backdoor malware.

🌍 Country China

Targeted Victims

Germany

Associated Operations

2024 2024-03 Chinese Espionage Campaign Expands to Target Africa and The Caribbean Inside the SharpPanda's Malware Targeting Malaysia https://blog.checkpoint.com/research/chinese-espionage-campaign-expands-to-target-africa-and-the-caribbean/ https://notes.netbytesec.com/2024/05/inside-sharppandas-malware-targeting.html

Introduction

SharpPanda, an APT group originating from China, has seen a rise in its cyber-attack operations starting from at least 2018. The APT group utilizes spear-phishing techniques to obtain initial access, employing a combination of outdated Microsoft Office document vulnerabilities, novel evasion techniques, and highly potent backdoor malware.

Activities and Tactics

Country of Origin: 🇨🇳 China

Suspected Victims: Germany

Notable Campaigns

  • 2024
  • 2024-03
  • Chinese Espionage Campaign Expands to Target Africa and The Caribbean
  • Inside the SharpPanda’s Malware Targeting Malaysia
  • https://blog.checkpoint.com/research/chinese-espionage-campaign-expands-to-target-africa-and-the-caribbean/
  • https://notes.netbytesec.com/2024/05/inside-sharppandas-malware-targeting.html

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Backdoor.Oldrea
  • China Chopper
  • CyberGate
  • Cyber Eye RAT
  • SharpEye
  • SharpBot
  • VictoryDLL:
  • Soul framework:
  • Cobalt Strike Beacon:
  • 8.t Dropper:
  • Cobalt Strike:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.