Goblin Panda – One of the World’s Most Active APTs
According to the Council on Foreign Relations, “This threat actor targets government agencies and entities in the defense and energy sectors in Southeast Asia with an interest in issues related to tensions in the South China Sea.”
According to Prevailian’s threat intelligence platform, this APT has been active in countries from the US to Asia, including India, Japan, South Korea, Vietnam and Australia as well as throughout Europe, the Middle East and Africa (EMEA).
Prevailion has also observed that Goblin Panda is three times more active than another major Chinese group, Mustang Panda. While it has been widely reported that the APT targets governments, it also targets many different industries and seemingly goes after well known names within those industries. Prevailion has detected that these industries include well known US tech companies, prominent cybersecurity companies, large telecoms and financial institutions as well as one of the world’s largest oil companies. It has also targeted privacy groups and four large universities in the US.
Believed to be backed by the Chinese government, Goblin Panda has grown increasingly infamous since it was first identified in 2013. In 2018, multiple reports attributed attacks on Vietnam to the APT. Kaspersky’s 2019 APT Report noted that Cycldek, (also known as Goblin Panda and Conimes) had become notorious for its information stealing and espionage campaigns that target both government entities–such as defense and energy–and the private sector using PlugX and HttpTunnel malware variants, Digital News Asia reported.
Goblin Panda has also been reported to leverage “a custom-designed stealthy tool called ‘USBCulprit’, which has sophisticated information-leeching capabilities, especially when used on an air-gapped system.”
Security researchers have warned about the APT’s use of this fairly new espionage tool to target air gapped systems, which reportedly uses rich-text format (RTF) documents to deliver Remote Access Trojans.
“We believe Goblin Panda to be a sophisticated threat actor with a broader target list than what has been previously revealed,” said Prevailion CEO and Founder Karim Hijazi. “In our own intelligence gathering activities, we have found their activities to be extensive, and not at all limited to Southeast Asia. Private sector CISOs should carefully evaluate their partners and supply chains, not only in Southeast Asia, but also in India, the Middle East and Africa.”
Introduction: Prevailion’s Adversarial Counterintelligence Team (PACT) is using advanced infrastructure hunting techniques and Prevailion’s unparalleled visibility into threat actor infrastructure creation to uncover previously unknown domains associated with UNC1151 and the “Ghostwriter” influence campaign. UNC1151 is likely a state-backed threat actor [1] waging an ongoing and far-reaching influence campaign that has targeted numerous countries across […]
Prevailion CEO, Karim Hijazi, comments on lacking White House cybersecurity efforts Karim Hijazi lays out why Biden’s cybersecurity strategy lacks innovation and effectiveness to deal with modern adversaries already inside companies around the globe.
Prevailion CEO, Karim Hijazi, talks about the T-Mobile hack and cloned SIM cards Karim Hijazi says T-Mobile’s breach is the largest in carrier history and discusses SIM swapping and other forms of identity theft.