Goblin Panda

Goblin Panda is a recognized threat actor, known for its malicious activities in the cyber world. Various research organizations have indicated that several Chinese Advanced Persistent Threat (APT) groups such as Growing Taurus (aka Naikon) and Parched Taurus (aka Goblin Panda) have leveraged this threat. Furthermore, a builder linked to this threat, which creates a file named '8.t', is widely used by Chinese APT groups including TA428, Goblin Panda, IceFog, and SongXY. Although not publicly accessible, this builder's usage indicates the extent of Goblin Panda's influence in the cyber threat landscape. In recent developments, ESET researchers detected a MirrorFace spearphishing campaign targeting political entities in Japan. They also noted a shift in the target interests of some China-aligned groups, with Goblin Panda beginning to mirror Mustang Panda’s focus on European countries. This evolution signifies a broadening of Goblin Panda's geographical scope and an increase in its threat potential. The software deployed by Goblin Panda includes Cobalt Strike, Quasar RAT, HDoor (a backdoor previously used by Chinese groups like Naikon and Goblin Panda), a Gh0st RAT variant known as Gh0stCringe, and Winnti - a multi-functional implant capable of granting remote control to an infected machine. These tools further demonstrate the sophistication and capabilities of Goblin Panda, highlighting the need for robust cybersecurity measures to counteract its threats.