Loading story…
CrowdStrike reported that MURKY PANDA, a China-nexus espionage group active since at least 2023, compromised cloud trusted relationships to reach downstream customer environments in North America. The actor targeted government, technology, academic, legal, and professional services organizations, first gaining access through internet-facing appliances by rapidly exploiting n-day and zero-day vulnerabilities, then deploying tools including the Neo-reGeorg web shell and the low-prevalence Linux malware family CloudedHope.
In cloud intrusions, the group abused Microsoft Entra ID application secrets, service principals, and delegated administrative privileges after compromising SaaS providers and a Microsoft cloud solution provider. Because Entra ID applications can create tenant-specific service principals with local permissions across multiple customer tenants, the attackers were able to pivot into downstream environments, access customer email, escalate privileges, and maintain persistence. CrowdStrike said the campaign was aimed at intelligence collection and was supported by strong operational security, including timestamp tampering, log sanitization, and the use of compromised SOHO devices as exit nodes.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
CrowdStrike reported notable MURKY PANDA activity since late 2024. The actor was observed using trusted-relationship compromises in cloud environments, including SaaS providers and a Microsoft cloud solution provider, to reach downstream customer tenants.
CrowdStrike said its Services and Counter Adversary Operations teams investigated multiple MURKY PANDA intrusions since 2023, describing the actor as active since at least that year. The activity included targeting organizations in North America and exploiting internet-facing appliances such as Citrix NetScaler.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Volexity reported that the China-linked threat actor **VerdantBamboo**—also tracked as **WARP PANDA** and `UNC5221`—compromised an organization through its managed services provider and maintained access for at least 18 months by abusing edge infrastructure and proprietary appliances. Investigators found the actor on an **Egnyte Storage Sync** appliance, where it deployed **BRICKSTORM** as its primary implant and used **AGENTPSD** as a fallback reverse shell, then pivoted with stolen credentials and SSL VPN access to reach internal systems and **Microsoft 365** while bypassing Conditional Access protections. The intrusion also affected the victim’s MSP, where Volexity found a **pfSense** firewall running a FreeBSD variant of **BRICKSTORM** and assessed with medium confidence that the MSP breach was the likely initial access path. During the investigation, Volexity identified a local privilege escalation issue tied to `sudo` permissions for Egnyte’s default `egnyteservice` account, later fixed in **Storage Sync v13.13**, and documented a new **.NET Native AOT** backdoor named **PLENET** on a **Synology NAS**. The findings indicate VerdantBamboo deliberately targets appliances and firewall-adjacent systems that often lack EDR coverage, using them as covert proxies and long-term persistence points.
Jun 29, 2026
APT41, a China-linked threat group, has deployed a new Linux ELF backdoor from the **Winnti** malware family to compromise cloud workloads and steal credentials from **AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud** environments. Researchers said the implant was built for stealth rather than disruption, harvesting metadata, temporary tokens, and local credential files while evading common detection methods; at the time of analysis, it reportedly had **zero detections on VirusTotal**. The malware abuses cloud metadata services, including the AWS instance metadata endpoint `169.254.169.254`, creating a path to broader cloud access when attached permissions are overly permissive. The campaign uses unusual tradecraft to blend into normal operations, including **SMTP-based command and control over port 25**, a selective handshake mechanism that limits exposure during scanning, and **UDP broadcast beacons on port 6006** that may support lateral movement. Investigators also linked the activity to typosquatted domains themed around **Alibaba Cloud** and **Qianxin**, with infrastructure reportedly registered through NameSilo and hosted in part on Alibaba Cloud in Singapore. Defenders were urged to monitor outbound SMTP from non-mail systems, watch for abnormal UDP broadcasts, audit metadata API access, enforce protections such as **AWS IMDSv2**, and strengthen cloud logging through services such as **CloudTrail** and **Google Cloud Audit Logs**.
Jun 29, 2026
China-linked espionage group **Earth Preta**—also tracked as **Mustang Panda**—updated its intrusion playbook to improve stealth, shifting from phishing emails with embedded malicious archives or direct cloud links to decoy documents that provide Google Drive links and passwords for protected archives. Those archives delivered malware including **TONEINS**, **TONESHELL**, and **PUBLOAD**, while follow-on activity used backdoors and loaders such as **CLEXEC**, **COOLCLIENT**, **TROCLIENT**, **PlugX**, and MQTT-based implants including **QMAGENT/MQsTTang**. Separate reporting tied Mustang Panda activity to targeted attacks in Asia, including Southeast Asia and likely Japan, where the group was also observed using malware such as **Claimloader**. Researchers said the actor expanded its post-compromise toolkit with privilege-escalation and lateral-movement utilities including **ABPASS**, **CCPASS**, **HIUPAN**, **ACNSHELL**, and abuse of **SilentCleanup** for elevation. For data theft, the group relied on both legitimate tools such as **WinRAR**, `curl`, and FTP and custom packers **NUPAKAGE** and **ZPAKAGE** to collect and encrypt sensitive documents for exfiltration. Infrastructure overlaps, malware artifacts, and developer traces—including the name **"TaoZongjie"** and the GitHub account **`YanNaingOo0072022`**—were cited as links across the broader Earth Preta intrusion set, underscoring a sustained and adaptive regional cyber-espionage campaign.
Aug 15, 2026