ctrlINT What the industry said about every indicator, with the quote

WARP PANDAThreat actor

WARP PANDA is a China-nexus APT that targets VMware vCenter environments and Microsoft Azure infrastructures, primarily focusing on legal, technology, and manufacturing sectors in the U. S. The group exploits internet-facing edge devices for initial access, later pivoting to vCenter environments using compromised credentials or vulnerabilities.From MISP Galaxy

Last reported 4 months ago, by Volexity1 report

Suspected originChinaMISP Galaxy

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1505.003Web Shell

    “Volexity found evidence of web shells, cryptocurrency miners, and alternate VPN configurations.”

    VolexityVendor
  2. T1556.009Conditional Access Policies

    “Volexity assesses with high confidence that this was done to blend in with legitimate network traffic and evade Conditional Access policies that would have otherwise prevented access.”

    VolexityVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “Ultimately, Volexity’s analysis revealed that a Chinese threat actor, which Volexity tracks as VerdantBamboo (WARP PANDA, UNC5221), had compromised the Storage Sync system.”

    VolexityVendor
    VerdantBamboo: Just Another BRICKSTORM in the Firewall

Indicators in its reports

named in the reports above
Copy these 14 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with WARP PANDA here?
No account needed. We do not store your IP address.