Vicious Panda
Vicious Panda is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government sector in Ukraine. It uses 11 MITRE ATT&CK techniques.
- Origin
- China
- Techniques
- 11
- Exploited CVEs
- No CVE data
- First seen
- Jan 4, 2021
- Last seen
- Jan 4, 2021
- Record updated
Who They Target.
Sectors · 1
Countries · 1
How They Operate · MITRE ATT&CK.
11 techniques across 7 of 14 tacticsReconnaissance3
T1057
Process Discovery
Process Discovery
T1082
System Information Discovery
System Information Discovery
T1497
Virtualization/Sandbox Evasion
Virtualization/Sandbox Evasion
Resource Development·
Persistence1
T1137.001
Office Application Startup: Office Template Macros
Office Application Startup: Office Template Macros
Privilege Escalation·
Defense Evasion·
Credential Access1
T1029
Scheduled Transfer
Scheduled Transfer
Discovery1
T1083
File and Directory Discovery
File and Directory Discovery
Lateral Movement·
Collection1
T1113
Screen Capture
Screen Capture
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- 8.t Droppermalware
Campaigns.
- The COVID CampaignMar 2020
Indicators Of Compromise.
TLP:AMBER43 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Vicious Panda.
Suspected Chinese threat group targeting East European and East Asian nations including Russia, Mongolia, and Ukraine.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.