Samurai Panda
Samurai Panda is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government, and Defense and Aerospace sectors in 5 countries, including the United States and the United Kingdom.
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2009
- Record updated
Who They Target.
Arsenal · Malware And Tools.
- FormerFirstRATmalware
- IsSpacemalware
- PlugXmalware
- Sykipotmalware
- ZLibmalware
About Samurai Panda.
Beginning in 2009, we’ve observed this actor conduct more than 40 unique campaigns that we’ve identified in the malware configurations’ campaign codes. These codes are often leveraged in the malware used by coordinated targeted attackers to differentiate victims that were successfully compromised from different target sets. The implant delivered by Samurai Panda uses a typical installation process whereby they: 1. Leverage a spear-phish with an exploit to get control of the execution flow of the targeted application. This file “drops” an XOR-encoded payload that unpacks itself and a configuration file. 2. Next, the implant, which can perform in several different modes, typically will install itself as a service and then begin beaconing out to an adversary-controlled host. 3. If that command-and-control host is online, the malicious service will download and instantiate a backdoor that provides remote access to the attacker, who will see the infected host’s identification information as well as the campaign code. State sponsor (ETDA): State-sponsored, PLA Navy.
Last updated Oct 21, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.