Emissary Panda

Emissary Panda, also known as APT27, Iron Tiger, Bronze Union, Budworm, Lucky Mouse, and Red Phoenix, is a threat actor linked to China. This group has been involved in cyberespionage activities with the primary goal of stealing intellectual property from organizations in sectors that China perceives as being strategically important. Emissary Panda has demonstrated a broad approach to its attacks, exploiting widespread vulnerabilities such as those found in SharePoint servers. The group has targeted a range of organizations across Europe, North and South America, Africa, the Middle East, and the Asia-Pacific region, including government entities and telecommunications providers. The group uses a variety of tools and techniques in its operations, including webshells like China Chopper, DLL sideloading, and custom-made post-exploitation tools. Code comparison between the sideloaded PYTHON33.dll uploaded to webshell and the inicore_v2.3.30.dll file sideloaded in previous Emissary Panda attacks reveals significant overlaps, suggesting a consistent methodology. Additionally, the group has deployed a previously unseen variant of its SysUpdate backdoor (SysUpdate DLL inicore_v2.3.30.dll), demonstrating their capacity for innovation and adaptation. Emissary Panda has shown a capability to disable antivirus protections, including by using a new variant of the Eagerbee backdoor. They have targeted critical Active Directory assets, notably the NTDS.dit file, the KRBTGT service account, and Active Directory certificates. Recent reports indicate that the group has launched new attacks with an updated SysUpdate toolkit against an Asian government and a Middle East-based telecommunications provider. These actions underscore the persistent threat posed by this group and the necessity for robust cybersecurity defenses.