Loading threat actor…
PurpleHaze is a China-nexus cyberespionage activity cluster associated with intrusions and reconnaissance observed from at least mid-2024 through 2025. The cluster has been linked with high confidence to Chinese state-aligned operations and shows technical and operational overlaps with publicly tracked groups including APT15, also known as Nylon Typhoon and Vixen Panda, and UNC5174. Reporting also uses Vixen Panda as an alias in connection with PurpleHaze, although the cluster appears to overlap multiple Chinese espionage ecosystems rather than map cleanly to a single legacy designation. PurpleHaze has targeted a South Asian government-supporting entity, a leading European media organization, SentinelOne, an IT services and logistics provider associated with SentinelOne, and more than 70 organizations globally across manufacturing, government, finance, telecommunications, research, and related sectors. The activity is consistent with strategic intelligence collection and pre-positioning, including reconnaissance of internet-facing infrastructure belonging to a cybersecurity vendor and targeting of supply-chain-adjacent organizations. Tradecraft associated with PurpleHaze includes exploitation of edge-device and appliance vulnerabilities for initial access, including Ivanti Cloud Services Appliance flaws CVE-2024-8963 and CVE-2024-8190, in some cases shortly before public disclosure. The cluster has used Operational Relay Box infrastructure to obscure command-and-control and route operations through compromised or leased intermediary nodes. Post-compromise tooling includes the Go-based GoReShell or GOREshell backdoor, which repurposes reverse SSH functionality from the open-source reverse_ssh project to establish covert outbound access. Related activity also involved ShadowPad, including variants obfuscated with ScatterBrain, and in some cases Nimbo-C2. Operators have used publicly available tools from The Hacker’s Choice community, along with anti-forensic measures such as log removal, timestomping, and obfuscation to hinder detection and attribution. Observed behaviors include reconnaissance, initial compromise, persistence through reverse SSH-style backdoors, post-exploitation activity, exfiltration in related ShadowPad-linked intrusions, and defense evasion through obfuscation and cleanup. PurpleHaze is best characterized as a Chinese cyberespionage cluster focused on high-value organizations, with particular interest in government-linked entities, media, telecommunications, research environments, and cybersecurity-adjacent targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
3 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
16 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a previously associated group for the reverse_ssh tunneling tool seen in this exploitation activity; the article does not attribute the current campaign directly to PurpleHaze.
Referenced as a threat cluster previously reported targeting a South Asian government-supporting entity using the GoReShell backdoor and reverse SSH functionality.
China-nexus threat cluster conducting reconnaissance against SentinelOne infrastructure and high-value customers.
Activity cluster associated (per SentinelLabs) with APT15 and UNC5174, including preparations/targeting related to SentinelOne; broader context overlaps with ShadowPad operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.