Loading threat actor…
Liminal Panda is a China-nexus cyber-espionage threat actor focused primarily on telecommunications infrastructure. The actor has been linked to long-term, stealth-oriented intrusions against telecom operators and related organizations, with activity observed since at least 2020 and substantial reporting on campaigns during 2024. It is also tracked as CL-STA-0969 and has been associated in some reporting with activity previously attributed to LightBasin/UNC1945, reflecting overlap and later attribution updates rather than a stable independent identity for those names. Liminal Panda is notable for deep operational knowledge of mobile core and roaming environments, including telecom signaling and packet-handling components used to support subscriber mobility and location services. Reported objectives include espionage and the collection of mobile subscriber information, call metadata, SMS-related data, and location intelligence. In several 2024 intrusions against Southeast Asian and Southwest Asian telecom infrastructure, the actor appeared to prioritize covert access and positioning within telecom environments for location-tracking or future intelligence collection rather than overt disruption. Tradecraft attributed to Liminal Panda includes initial access through brute-force attacks against SSH and other authentication mechanisms using telecom-tailored credential dictionaries, followed by privilege escalation on Linux systems through known local privilege-escalation vulnerabilities. The actor has demonstrated persistence through PAM backdoors and other custom implants, and has used reverse tunnels, DNS-based command-and-control, ICMP-based backdoors, and telecom-specific tunneling mechanisms to maintain resilient access. Custom malware and tooling associated with the cluster include ChronosRAT/MystRodX, NoDepDNS, GTPDoor, EchoBackdoor, AuthDoor, CordScan, and use of an SGSN emulator for covert pivoting through mobile network infrastructure. Defense evasion and operational security are central to Liminal Panda’s operations. Reported techniques include process masquerading, timestomping, log sanitization, disabling or weakening SELinux protections, routing traffic through compromised mobile operators, and tunneling over protocols or ports that blend into telecom operations. The actor has also been described as favoring stealth over immediate exfiltration, with some investigations finding no confirmed bulk data theft despite clear evidence of persistent access and telecom-focused reconnaissance. Victimology consistently centers on telecommunications providers and telecom-connected organizations, with additional reported targeting of government agencies and military entities in Latin America. Reporting also places the actor among Chinese espionage groups active against Asian telecoms and European telecommunications targets. Available evidence supports classification as a state-linked espionage actor with a dominant intelligence-collection mission.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
23 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
18 malware families attributed to this actor across reporting.
13 additional families tracked in Mallory.
23 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an example of a state-sponsored espionage group in the telecom surveillance landscape.
Telecom-focused espionage actor known for compromising telecom operator networks to collect subscriber information, call metadata, and SMS messages using customized signaling tools.
Targeting government agencies, telecom providers, and military entities in Latin America.
State-sponsored cluster targeting Southeast Asian telecommunications to enable remote control over compromised networks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.