- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2018
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0342 · sharppanda
ChinaWhat it is
SharpPanda, an APT group originating from China, has seen a rise in its cyber-attack operations starting from at least 2018. The APT group utilizes spear-phishing techniques to obtain initial access, employing a combination of outdated Microsoft Office document vulnerabilities, novel evasion techniques, and highly potent backdoor malware.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Sharp Panda
- Other names
- Sharp Dragon, Sharp Dragon (CHKPT), SharpPanda, Sharp Dragon
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Germany, Indonesia, Malaysia, Thailand, Vietnam
- Sectors
- Government
Tools
The tools and malware families the sources tie to it.
- 8.t Dropper
- Backdoor.Oldrea
- China Chopper
- Cobalt Strike
- Cobalt Strike Beacon
- Cyber Eye RAT
- CyberGate
- SharpBot
- SharpEye
- Soul framework
- VictoryDLL
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de