panda

Panda is a threat actor name associated with at least two distinct clusters of malicious activity reflected in available reporting: a financially motivated cryptojacking operation tracked from 2018 to 2019, and malware code-base overlaps with an APT campaign targeting Vietnam. The strongest, directly supported body of evidence ties Panda to a large-scale illicit cryptocurrency mining campaign commonly associated with MassMiner activity. In the cryptomining operations, Panda exploited public-facing server vulnerabilities including CVE-2017-10271 in Oracle WebLogic, CVE-2017-5638 in Apache Struts 2, CNVD-2018-24942 in ThinkPHP, and later CVE-2019-2725 in Oracle WebLogic. The actor used internet-wide scanning to identify vulnerable systems, then retrieved miner payloads through PowerShell or certutil-based download chains. Post-compromise behavior included deployment of Monero miners, installation of auxiliary tooling, scheduled-task-based execution and persistence, firewall tampering, and modification of file permissions. Panda also demonstrated substantial post-exploitation capability. Observed tradecraft included SMB scanning, brute forcing, lateral movement, credential theft using Mimikatz, and use of exploit components associated with Shadow Brokers and EternalBlue-style propagation. Some infections additionally deployed Gh0st RAT, indicating the actor sometimes combined cryptomining with remote-access functionality. Victim profiling included use of Chinese-language IP geolocation services. The actor repeatedly rotated infrastructure while preserving broadly consistent tactics, techniques, and procedures. Confirmed victim sectors for Panda’s mining campaigns included banking, health care, transportation, telecommunications, and information technology services. Available evidence also links the Panda name to malware sharing a code base with an earlier campaign targeting Vietnam that used a weaponized RTF lure exploiting an Equation Editor vulnerability and a scheduled-task-executed DLL payload. However, the relationship between that Vietnam-focused activity and the MassMiner cryptojacking cluster is not sufficiently resolved here to treat them as a single fully unified intrusion set beyond the shared Panda attribution label. Available evidence supports a China nexus for Panda. The actor’s observed behavior and infrastructure registration details are consistent with operation by a Chinese-speaking threat actor. Panda is best characterized, on the strongest supported evidence, as a financially motivated intrusion actor focused on opportunistic exploitation of exposed enterprise services for cryptocurrency mining, with additional credential theft, lateral movement, and remote-access capabilities.