Loading threat actor…
Glacial Panda is a China-linked cyber espionage threat actor focused on telecommunications environments. The group has been reported targeting telecom organizations across multiple countries and is notable for concentrating on Linux systems, including legacy and unmanaged servers that support older technologies. Its operations are consistent with long-term intelligence collection, including theft of call detail records and communications telemetry. Glacial Panda commonly gains access by exploiting known vulnerabilities or weak passwords on internet-facing systems, then escalates privileges on compromised Linux hosts using publicly known local privilege escalation flaws such as Dirty COW and PwnKit. A defining tradecraft element is deployment of trojanized OpenSSH components referred to as ShieldSlide, which are used to harvest credentials and authentication sessions while also providing covert backdoor access. This combination of credential theft, persistence, privilege escalation, and data exfiltration aligns with sustained post-compromise espionage activity in telecom networks. The actor is assessed as part of the broader cluster of China-nexus intrusion activity targeting strategic sectors. No additional widely established aliases or sub-groups are directly supported beyond Glacial Panda.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
2 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Attack chains implemented by the threat actor make use of known security vulnerabilities or weak passwords aimed at internet-facing and unmanaged servers, with follow-on activities leveraging privilege escalation bugs like CVE-2016-5195 (aka Dirty COW) and CVE-2021-4034 (aka PwnKit).
Attack chains implemented by the threat actor make use of known security vulnerabilities or weak passwords aimed at internet-facing and unmanaged servers, with follow-on activities leveraging privilege escalation bugs like CVE-2016-5195 (aka Dirty COW) and CVE-2021-4034 (aka PwnKit).
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-linked espionage intrusions against telecommunications organizations to access and exfiltrate call detail records and communications telemetry; targets Linux/legacy telecom systems; uses vulnerability exploitation/weak passwords, privilege escalation, LotL, and trojanized OpenSSH for credential theft and backdoor access.
Glacial Panda is a China-linked group targeting the telecom sector, focusing on legacy Linux systems, deploying trojanized OpenSSH tools, and collecting authentication logs for lateral movement.
China-nexus endpoint-focused actor conducting long-dwell, stealthy intrusions for intelligence collection in telecommunications; targets Linux (including legacy) systems; deploys trojanized OpenSSH to log auth events and enable lateral movement via tracking remote connections (ShieldSlide).
Long-term cyberespionage operations using advanced custom malware implants.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.