GINC-APT-0169 · State

APT14

Also Anchor Panda, Aluminum, Anchor Panda, APT 14, APT 14, APT-14, QAZTeam.

Category
State · Attributed to a state or working for one.
Origin
China(high confidence)
Sponsor
State-sponsored, PLA Navy
Agency named
PLA
Motivation
Espionage; Information theft and espionage
Seen
2012
Sources
7 sources carry it
Identifier
GINC-APT-0169 · apt14

What it is

PLA Navy Anchor Panda is an adversary that CrowdStrike has tracked extensively over the last year targeting both civilian and military maritime operations in the green/brown water regions primarily in the area of operations of the South Sea Fleet of the PLA Navy. In addition to maritime operations in this region, Anchor Panda also heavily targeted western companies in the US, Germany, Sweden, the UK, and Australia, and other countries involved in maritime satellite systems, aerospace companies, and defense contractors. Not surprisingly, embassies and diplomatic missions in the region, foreign intelligence services, and foreign governments with space programs were also targeted.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CrowdStrike
Anchor Panda
Mandiant
APT 14
Other names
Aluminum, Anchor Panda, APT 14, APT-14, QAZTeam

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Targets

Countries
Australia, Germany, Sweden, United Kingdom, United States
Sectors
Aerospace, Defense, Engineering, Government, Industrial, Intelligence, Maritime, Military, Other, Space

Tools

The tools and malware families the sources tie to it.

  • Adobe Gh0st
  • Gh0st RAT
  • Poison Ivy
  • SPACESHIP
  • Torn RAT

Sources