Panda
Panda is a threat actor group, tracked by Brandefense. It targets the Government sector in Vietnam. It uses 11 MITRE ATT&CK techniques.
- ThunderCats
- Operation “LagTime IT”
- Operation “StealthyTrident”
- Techniques
- 11
- Exploited CVEs
- No CVE data
- First seen
- Jul 6, 2025
- Last seen
- Jul 6, 2025
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
11 techniques across 4 of 14 tacticsReconnaissance·
Resource Development1
Supply Chain Compromise: Compromise Software Supply Chain
Initial Access·
Execution5
Command and Scripting Interpreter: Windows Command Shell
Native API
Deobfuscate/Decode Files or Information
System Binary Proxy Execution: Rundll32
Reflective Code Loading
Persistence1
Create or Modify System Process: Windows Service
Privilege Escalation·
Defense Evasion4
Obfuscated Files or Information
Obfuscated Files or Information: Dynamic API Resolution
Masquerading: Match Legitimate Resource Name or Location
Indicator Removal: File Deletion
Credential Access·
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- ElephantRATmalware
Campaigns.
- Operation NightScoutSep 2020 to Jan 2021
Indicators Of Compromise.
TLP:AMBER6 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Panda.
These campaigns originated from adversary-operated free email sender accounts at yahoo[.]co[.].jp and yahoo[.]com. Sender addresses often imitated common names found in the languages of targeted entities. Spear phishing emails included malicious.doc attachments that were actually RTF files saved with.doc file extensions. The lures used in the subjects, attachment names, and attachment content in several cases utilized information technology themes specific to Asia such as governmental or public training documents relating to IT. On one specific occasion an email utilized the subject “ITU Asia-Pacific Online CoE Training Course on ‘Conformity & Interoperability in 5G’ for the Asia-Pacific Region, 15-26 April 2019” and the attachment name “190315_annex 1 online_course_agenda_coei_c&i.doc”. The conference referenced in the lure was an actual event likely selected due to its relevance to potential victims. This is significant as countries in the APAC region continue to adopt Chinese 5G technology in government as well as heavy equipment industries. This actor worked together with 'Emissary Panda, APT 27, LuckyMouse, Bronze Union' in Operation StealthyTrident.
Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.