Emissary Panda

Threat Actor Profile Updated 24 days ago
Download STIX
Preview STIX
Emissary Panda, also known as Iron Tiger, Bronze Union, Budworm, APT27, Lucky Mouse, and Red Phoenix, is a threat actor group known for its malicious cyber activities. The group has been active since at least 2013, targeting a wide range of industries and organizations across Europe, North and South America, Africa, the Middle East, and the Asia-Pacific region. This threat actor group has demonstrated its capabilities by exploiting widespread vulnerabilities such as SharePoint, targeting critical Active Directory assets, and deploying sophisticated tools like the SysUpdate backdoor. The group's modus operandi includes the use of custom-made post-exploitation tools, webshells, and DLL sideloading techniques to execute their attacks. Notably, the China Chopper webshell was found on compromised SharePoint servers, a tool that has been previously associated with Emissary Panda. Furthermore, code comparison between the sideloaded PYTHON33.dll uploaded to the webshell and the inicore_v2.3.30.dll file sideloaded in previous Emissary Panda attacks reveals significant overlaps, indicating a consistent pattern in their attack methodology. Recent cyberespionage campaigns have targeted an Asian government and a Middle East-based telecommunications provider, demonstrating the group's ongoing development of cyber-espionage tools. The SysUpdate malware, a remote access trojan (RAT) associated with this group since 2020, supports Windows service, process, and file management, command execution, data retrieval, and screenshot capturing. This advanced persistent threat (APT) operation continues to pose a significant risk to organizations worldwide due to its broad targeting approach and evolving toolkit.
What's your take? (Question 1 of 5)
2021c4cf-9fda-4372-8314-c5c2e882d637 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
APT27
7
APT27, also known as Iron Taurus, is a threat actor suspected to be originating from China. The group primarily engages in cyber operations with the goal of intellectual property theft, targeting organizations globally including those in North and South America, Europe, and the Middle East. APT27 ut
LuckyMouse
4
LuckyMouse, also known as Budworm, Emissary Panda, and APT27, is a threat actor that has been involved in several high-profile cyber-espionage activities. The group has demonstrated its ability to develop and deploy advanced cyber tools, targeting various operating systems including MacOS, Linux, an
SysUpdate
4
SysUpdate is a malicious software variant that has been exclusively used by Budworm, also known as APT27, Emissary Panda, Bronze Union, Lucky Mouse, Iron Tiger, and Red Phoenix. In December 2020, a sample of the SysUpdate malware variant was found, with its payload being a new version of SysUpdate.
Lucky Mouse
3
Lucky Mouse, also known as Emissary Panda, APT27, Threat Group 3390, Bronze Union, and several other names, is a malicious software (malware) attributed to a China-linked Advanced Persistent Threat (APT) group. This malware has been active since at least 2013, targeting various industry verticals fo
inicore_v2.3.30.dll
2
The malware inicore_v2.3.30.dll is a harmful program designed to exploit and damage computer systems, often infiltrating them via suspicious downloads, emails, or websites without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for
BRONZE UNION
2
Bronze Union, also known as APT27, Emissary Panda, Lucky Mouse, Iron Tiger, and Red Phoenix, is a threat actor with alleged connections to the Chinese government. The group has been observed targeting organizations across Europe, North and South America, Africa, the Middle East, and the Asia-Pacific
Budworm
2
Budworm, also known as LuckyMouse or APT 27, is a threat actor that has been associated with various high-profile cyber attacks. This group has been found to utilize tools such as the Korplug backdoor, which is commonly used by multiple Advanced Persistent Threats (APTs) including Budworm and APT41,
Iron Tiger
2
Iron Tiger, also known as APT 27 or Iron Taurus, is a threat actor group believed to be of Chinese origin. The group has been active since at least 2015, when it was linked to Operation Iron Tiger, a series of cyber-espionage attacks targeting United States defense contractors. These attacks were pr
Cobra Docguard
2
Cobra DocGuard, a software produced by Chinese firm EsafeNet for protecting, encrypting, and decrypting software, has been exploited in a series of malware attacks. The attackers compromised the software's update files to deliver malicious updates that infected targeted systems. The first known inst
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Apt
Malware
Espionage
Windows
Sharepoint
Backdoor
Vulnerability
Exploit
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
CobraUnspecified
2
Cobra is a type of malware, short for malicious software, designed to exploit and damage computer systems or devices. It can infiltrate systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, Cobra has the potential to steal personal information, disrup
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Emissary Panda Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
8 months ago
Multiple Chinese APTs are attacking European targets, EU cyber agency warns | #ukscams | #datingscams | #european | #datingscams | #love | #relationships | #scams | #pof | #match.com | #dating | National Cyber Security Consulting
CERT-EU
8 months ago
Budworm hackers target telcos and govt orgs with custom malware
CERT-EU
7 months ago
Domain of Thrones: Part I
CERT-EU
a year ago
Operation Soft Cell: Chinese Hackers Breach Middle East Telecom Providers
MITRE
a year ago
Emissary Panda Attacks Middle East Government SharePoint Servers
InfoSecurity-magazine
8 months ago
Budworm APT Evolves Toolset, Targets Telecoms and Government
Securityaffairs
9 months ago
Carderbee APT targets Hong Kong orgs via supply chain attacks
CERT-EU
8 months ago
China-Linked Budworm Targeting Middle Eastern Telco and Asian Government Agencies
Checkpoint
a year ago
6th March – Threat Intelligence Report - Check Point Research
DARKReading
a year ago
Linux Support Expands Cyber Spy Group's Arsenal
BankInfoSecurity
9 months ago
Threat Actor Targets Hong Kong With Korplug Backdoor
MITRE
a year ago
Emissary Panda – A potential new malicious tool
MITRE
a year ago
Exchange servers under siege from at least 10 APT groups | WeLiveSecurity
MITRE
a year ago
Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”
CERT-EU
9 months ago
Previously unknown hacking group targets Hong Kong organizations in supply chain cyberattack
CERT-EU
8 months ago
Budworm: APT Group Uses Updated Custom Tool in Attacks on Government and Telecoms Org - Cyber Security Review
CERT-EU
8 months ago
DDoS attack hits Russian flight booking system claimed by Ukrainian hackers
CERT-EU
8 months ago
Asian government, telco targeted by Chinese APT
CERT-EU
8 months ago
Cyber Security Week in Review: September 29, 2023