Loading threat actor…
SharpPanda is a China-linked cyber-espionage threat actor focused primarily on government and other strategic targets in Southeast Asia. The group has been associated with long-running espionage activity against regional government entities and has also been linked to operations affecting Malaysia, Vietnam, Thailand, and Indonesia. Check Point later used the alternate name Sharp Dragon for the same activity cluster. SharpPanda is also referenced alongside other China-aligned intrusion sets that use overlapping tooling and tradecraft. SharpPanda is known for spear-phishing-led initial access, including government-themed lure documents and weaponized RTF files created with RoyalRoad. In more recent activity, the group expanded beyond earlier RoyalRoad and Equation Editor-centric delivery patterns by using a new dropper disguised as a document to deploy the 5.t framework. That dropper searched for word-processing software to open a decoy document, attempted to load malicious DLLs already present on disk, and established persistence through scheduled tasks created via COM APIs. Analysis of the dropper also identified imports and code paths consistent with potential spyware functionality such as keylogging and screenshot capture. The actor has used custom malware including the 5.t Downloader, VictoryDll, SoulSearcher, and the modular Soul backdoor framework. In one documented campaign, the initial infection chain used a remote-template Word document to retrieve a RoyalRoad weaponized RTF, which then deployed 5.t Downloader. Earlier SharpPanda activity commonly ended with VictoryDll, while later operations substituted SoulSearcher to retrieve, decrypt, and reflectively load modules of the Soul framework in memory. Soul-related tooling used registry-based storage, reflective DLL loading, modular command handling, victim fingerprinting, and custom HTTP-based command-and-control communications with time-based operational controls. SharpPanda places notable emphasis on reconnaissance and host profiling. Observed malware collected detailed system information including host, operating system, user, network interface, installed software, and process data before encrypting and transmitting it to command infrastructure. Reporting also characterizes the group as conducting comprehensive network reconnaissance before targeted follow-on activity. The actor’s observed capabilities include initial access via phishing, persistence through scheduled tasks, reconnaissance and system information discovery, keylogging-related functionality, exfiltration of collected host data, and defense evasion through obfuscation, encrypted communications, API hashing, string hashing, stack strings, and in-memory loading. Available reporting consistently characterizes SharpPanda as a Chinese-backed espionage operation rather than a financially motivated or ransomware actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
38 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed among detected threat actors/TTP references, but not substantively discussed in the report summary.
Chinese-linked intrusion set using a new dropper/loader to deploy the 5.t framework, dropping a malicious DLL disguised as an .ini file, creating a scheduled task for persistence, and historically relying on RoyalRoad in campaigns targeting Southeast Asia.
Espionage-style malware activity targeting Malaysia in March-April 2024 using a malicious executable that establishes a backdoor/C2 connection, collects host information, encrypts it, and sends it to attacker infrastructure.
Performs extensive system information discovery and reconnaissance prior to targeted attacks; uses a loader/downloader to collect host data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.