Loading threat actor…
Samurai Panda is a China-linked advanced persistent threat actor associated with targeted intrusion activity and use of the NfLog remote access trojan, also known as IsSpace. The group has been linked to exploitation-based initial access, including deployment of malware through a repurposed Adobe Flash exploit for CVE-2015-5122. Reported tradecraft includes use of proxy-layered command-and-control infrastructure, malware with embedded configuration data, and frequent command polling behavior typical of lightweight remote administration tooling. Observed capabilities associated with Samurai Panda include initial access through client-side exploitation, credential collection from proxy authentication contexts, privilege escalation, persistence, and post-compromise remote control. NfLog has been described as proxy-aware and capable of attempting to obtain proxy credentials, relaunching itself with elevated privileges, and using DLL side-loading involving CryptBase.dll as a UAC bypass and privilege-escalation mechanism on newer Windows systems. Persistence has been established through autorun extensibility mechanisms after installation. The malware family attributed to the actor is a relatively simple RAT rather than a highly modular platform, but it still supports core backdoor functions needed for sustained access. Samurai Panda has also been referenced in connection with exploit-development or exploit-reuse clusters that used characteristic encrypted payload markers seen across multiple China-linked intrusion sets, including Anchor Panda and Temper Panda. High-confidence reporting in the available material supports association with Chinese threat activity, but does not provide a broader, fully corroborated victimology profile for this actor beyond the malware and exploit usage described.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a group previously observed using the 'PdPD' marker for encrypted binaries; no direct activity described in this report beyond that overlap indicator.
Uses the NfLog RAT, deploying a new variant via a repurposed leaked Hacking Team Adobe Flash exploit leveraging CVE-2015-5122, with Google App Engine used to proxy C2 communications.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.