Loading threat actor…
Hurricane Panda is a China-linked threat actor associated with cyber espionage and, in some reporting, disruptive operations aligned with Beijing’s political interests. The group has been described as PRC-aligned and has been linked to activity targeting East Asia and the United States, with a focus on espionage and intellectual property theft. Reporting has also connected Hurricane Panda to campaigns surrounding politically sensitive events in Hong Kong, including activity tied to the Occupy Central and Umbrella Movement period. The actor has been associated with exploitation of CVE-2014-4113, indicating capability for initial compromise through zero-day privilege-escalation exploitation. Available reporting supports characterization of the group as an intrusion-focused actor involved in post-compromise espionage operations rather than a ransomware or financially motivated extortion group. Hurricane Panda is also referenced in connection with the broader Poisoned Hurricane activity cluster, which has been linked to distributed denial-of-service activity against Hong Kong-related targets during periods of political unrest. Known naming in the supplied material centers on Hurricane Panda, with Poisoned Hurricane referenced as a related activity cluster. High-confidence reporting supports assessment that the actor is aligned with Chinese state interests and primarily motivated by espionage.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PRC-aligned activity cluster linked in the report to DDoS attacks suppressing Hong Kong’s democracy movement; also described as primarily conducting espionage and intellectual property theft in East Asia and the U.S.
Chinese espionage actor discussed in connection with campaigns around Hong Kong and use of a Windows zero-day.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.