Threat Intelligence Garden

APT 20, Violin Panda

2 min read

APT 20, Violin Panda

Description

(Palo Alto) We’ve uncovered some new data and likely attribution regarding a series of APT watering hole attacks this past summer. Watering hole attacks are an increasingly popular component of APT campaigns, as many people are more aware of spear phishing and are less likely to open documents or click on links in unsolicited emails. Watering hole attacks offer a much better chance of success because they involve compromising legitimate websites and installing malware intended to compromise website visitors. These are often popular websites frequented by people who work in specific industries or have political sympathies to which the actors want to gain access. In contrast to many other APT campaigns, which tend to rely heavily on spear phishing to gain victims, “th3bug” is known for compromising legitimate websites their intended visitors are likely to frequent. Over the summer they compromised several sites, including a well-known Uyghur website written in that native language.

This group could be related to Axiom, Group 72.

Names

NameName-Giver
APT 20FireEye
APT 8Mandiant
Violin PandaCrowdstrike
TH3BugPalo Alto
Crawling TaurusPalo Alto

Country

Motivation

  • Information theft and espionage

First Seen

2014

Observed Sectors

Observed Countries

Tools

Operations

Information

Playbook

Other Information

Uuid

73a85c37-08ef-4df4-ac98-7cb07b58715b

Last Card Change

2024-03-10

Graph View

Backlinks