Loading threat actor…
Goblin Panda is a China-linked espionage threat actor widely associated with long-running operations against governments and strategic organizations in Asia, especially Vietnam. The actor has also been referred to as 1937CN by some vendors, and public reporting has at times treated Goblin Panda and 1937CN as effectively interchangeable. Activity attributed to this cluster has been tied to Chinese state interests and to campaigns aligned with regional geopolitical disputes, particularly in the South China Sea. Goblin Panda is known for spear-phishing-led intrusions using politically themed decoy documents and exploit-laden RTF files, including documents generated with the Royal Road weaponizer. Reported delivery chains have exploited Microsoft Equation Editor vulnerabilities such as CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802. The actor has repeatedly used DLL side-loading or DLL search-order hijacking with legitimate signed executables to launch malware, and has been linked to malware families and clusters including PoisonIvy, Chinoxy, PivNoxy, and USBCulprit. Public reporting also associates the actor with USB-based air-gap intrusion tooling used for espionage. Observed post-compromise behavior includes process injection, persistence through scheduled tasks or startup-related mechanisms, reconnaissance, payload retrieval, and information theft. PoisonIvy-linked activity associated with this cluster has been assessed as enabling broader post-exploitation actions such as lateral movement and theft of information across victim environments. Reporting also connects the actor to supply-chain-style compromise activity in Southeast Asia through Operation NightScout, where related tooling again used Logitech-themed DLL hijacking to deliver follow-on payloads. Targeting has centered on Vietnam’s government and aviation sectors, including long-running operations since at least 2014 and public attribution by Vietnam for the 2016 attacks on airport communications systems and Vietnam Airlines. Broader reporting places Goblin Panda activity across South Asia, Southeast Asia, and East Asia, with references to targeting or operational interest involving India, Japan, South Korea, Laos, Malaysia, the Philippines, Thailand, Indonesia, and Russia. The actor is consistently characterized as espionage-focused rather than financially motivated.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
17 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
RoyalRoad is a tool that generates weaponized RTF documents that exploit the following vulnerabilities in Microsoft’s Equation Editor: CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802.
RoyalRoad is a tool that generates weaponized RTF documents that exploit the following vulnerabilities in Microsoft’s Equation Editor: CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802.
RoyalRoad is a tool that generates weaponized RTF documents that exploit the following vulnerabilities in Microsoft’s Equation Editor: CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named threat actor referenced in global threat reporting.
Mentioned as another Chinese-linked group known to use RoyalRoad.
Mentioned only as an example of Chinese threat actor naming conventions in discussion of attribution.
Targeted attack activity using Royal Road weaponized RTF documents exploiting Equation Editor vulnerabilities to execute payloads.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.