APT24Threat actor
- g0011
- pitty panda
- temp.pittytiger
The Pitty Tiger group has been active since at least 2011. They have been seen using HeartBleed vulnerability in order to directly get valid credentialsFrom MISP Galaxy
Last reported 1 month ago, by Google Threat Intelligence1 report
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1027.007Dynamic API Resolution
“Supply source code to Gemini to implement evasion and obfuscation tactics and consolidate foothold (e.g., dynamic API resolution via PEB parsing, rolling XOR encryption of C2 IP addresses).”
- T1036Masquerading
“Masquerading CI/CD Pipeline Tasks as Legitimate AI Utilities”
- T1055Process Injection
“…g assistants such as DeepSeek-Coder to develop Python-based Remote Access Trojans (RATs) incorporating cross-platform persistence, process injection, fileless execution, defense evasion, and C2 notifications.”
- T1110.003Password Spraying
“Leverage Gemini to write and refine asynchronous Python scripts designed to perform automated password spraying against target services.”
- T1195Supply Chain Compromise
“…g multiple tactics to trick AI coding assistants and large language model (LLM) security scanners into its open source software supply chain compromises.”
- T1684Social Engineering
“…cyber crime groups continue to use AI capabilities as force multipliers across the attack lifecycle—from target reconnaissance and social engineering lure creation to custom malware obfuscation and post-exploitation troubleshooting.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“RAVINE CASTLE, a PRC-nexus cyber espionage group previously known as COULEE, APT24, misuses Gemini across multiple distinct operations to conduct wide-ranging, task-specific objectives spanning the entire attack lifecycle, ranging from intelligence gathering, attack capability de…”
Thanks — we review every report.