Twisted Panda
Twisted Panda is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Defense and Aerospace sector in Russia and Belarus.
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2021
- Record updated
Who They Target.
About Twisted Panda.
This campaign is a continuation of what is believed to be a long-running espionage operation against Russian-related entities that has persisted since at least July 2021. The operation may still be ongoing, as the most recent activity was observed in April 2022. This activity was attributed to a Chinese threat actor, with possible connections to {{Stone Panda, APT 10, menuPass}}, a sophisticated and experienced nation-state-backed actor, and Mustang Panda, another proficient China-based cyber espionage group. The campaign has been dubbed Twisted Panda to reflect the sophistication of the tools observed and the attribution to China. The hackers use new tools, which have not previously been described: a sophisticated multi-layered loader and a backdoor dubbed SPINNER. These tools use advanced evasion and anti-analysis techniques such as multi-layer in-memory loaders and compiler-level obfuscations.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.