Putter Panda

Threat Actors · Putter Panda

· ATT&CK GroupG0024

APT2MSUpdater

Techniques

Software

Tactics

Aliases

Description

Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). (Citation: CrowdStrike Putter Panda)

Tactic Coverage

stealth (2)privilege escalation (2)persistence (1)defense impairment (1)

Techniques Used (4)

T1027.013Encrypted/Encoded File

stealth

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1685Disable or Modify Tools

defense impairment

Software Used (4)

S00663PARA RATmalware S00654H RATmalware S0068httpclientmalware S0067pngdownermalware

References (6)

https://attack.mitre.org/groups/G0024 http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf https://blogs.blackberry.com/en/2016/01/puttering-into-the-future