- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD)
- Agency named
- PLA, Unit 61486
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2007–2026
- Status
- Active
- ATT&CK
- G0024 · 4 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0335 · putter-panda
ChinaWhat it is
Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD).
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Government agency
- PLA Unit 61486
- Mandiant
- APT2, APT 2
- MITRE ATT&CK
- G0024
- Secureworks
- TG-6952
- Talos and others
- Group 36
- Other names
- 4HCrew, MSUpdater, Putter Panda, APT 2, SearchFire, Sulphur
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- U.S. satellite and aerospace sector, United States
- Sectors
- Defense, Government, Private sector, Research, Technology
Tools
The tools and malware families the sources tie to it.
- 3PARA RAT
- 4H RAT
- httpclient
- pngdowner
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de