Loading threat actor…
LuoYu, also tracked as SinisterEye and sometimes referred to as Cascade Panda, is a China-aligned cyber espionage threat actor associated with Chinese-speaking operators. Attribution to a specific Chinese state entity remains analytically contested, but the group is consistently assessed as aligned with Beijing’s geopolitical interests. LuoYu is notable for using adversary-in-the-middle techniques to hijack legitimate software update mechanisms, including DNS or network-traffic interception, to gain access to victim environments and support lateral movement. The group has been linked to ISP-level or backbone-level interception used to deliver espionage malware such as WinDealer and SpyDealer against foreign entities operating within China. Reported tradecraft centers on covert initial access, update hijacking, and post-compromise movement inside networks, reflecting a mature capability for network-level manipulation and stealthy espionage operations.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.