Loading threat actor…
LuoYu, also tracked as SinisterEye and sometimes referred to as Cascade Panda, is a China-aligned cyber espionage threat actor associated with Chinese-speaking operators. Attribution to a specific Chinese state entity remains analytically contested, but the group is consistently assessed as aligned with Beijing’s geopolitical interests. LuoYu is notable for using adversary-in-the-middle techniques to hijack legitimate software update mechanisms, including DNS or network-traffic interception, to gain access to victim environments and support lateral movement. The group has been linked to ISP-level or backbone-level interception used to deliver espionage malware such as WinDealer and SpyDealer against foreign entities operating within China. Reported tradecraft centers on covert initial access, update hijacking, and post-compromise movement inside networks, reflecting a mature capability for network-level manipulation and stealthy espionage operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Unattributed espionage group focused on foreign diplomatic organizations, foreign companies, and foreign nationals inside China, notable for ISP/backbone-level interception and passive malware delivery.
China-aligned actor using adversary-in-the-middle positioning to hijack legitimate software update mechanisms, delivering Windows and Android malware families.
SinisterEye is a China-aligned APT group using adversary-in-the-middle techniques for both initial access and lateral movement.
China-linked actor using adversary-in-the-middle (AiTM) to hijack software update mechanisms and enable stealthy malware implantation and lateral movement.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.