- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, PLA Navy
- Agency named
- PLA
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2012
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0169 · apt14
What it is
PLA Navy Anchor Panda is an adversary that CrowdStrike has tracked extensively over the last year targeting both civilian and military maritime operations in the green/brown water regions primarily in the area of operations of the South Sea Fleet of the PLA Navy. In addition to maritime operations in this region, Anchor Panda also heavily targeted western companies in the US, Germany, Sweden, the UK, and Australia, and other countries involved in maritime satellite systems, aerospace companies, and defense contractors. Not surprisingly, embassies and diplomatic missions in the region, foreign intelligence services, and foreign governments with space programs were also targeted.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Anchor Panda
- Mandiant
- APT 14
- Other names
- Aluminum, Anchor Panda, APT 14, APT-14, QAZTeam
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Australia, Germany, Sweden, United Kingdom, United States
- Sectors
- Aerospace, Defense, Engineering, Government, Industrial, Intelligence, Maritime, Military, Other, Space
Tools
The tools and malware families the sources tie to it.
- Adobe Gh0st
- Gh0st RAT
- Poison Ivy
- SPACESHIP
- Torn RAT
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de