Loading threat actor…
Twisted Panda is a China-linked cyber-espionage activity cluster identified in operations targeting Russian defense-related research organizations and a research entity in Belarus. The campaign is assessed with high confidence to be conducted by a Chinese state-backed threat actor, although available evidence does not support definitive attribution to a specific named group. Tradecraft overlaps have been noted with activity associated with APT10 and Mustang Panda, but Twisted Panda is best treated as a distinct reporting name for this espionage campaign rather than a confirmed synonym for either actor. The operation focused on defense and research targets aligned with Chinese strategic intelligence interests, including defense technology, aviation, robotics, and medical equipment. Observed activity dates back to at least mid-2021 and continued into 2022. Initial access relied on spear-phishing emails using topical lures related to sanctions on Russia and biological weapons narratives involving Belarus. The infection chain used malicious documents and external templates with macros to stage multiple payloads. Twisted Panda employed a layered malware architecture featuring loaders, persistence components, and a backdoor named SPINNER. The intrusion chain used DLL sideloading, in-memory decryption, scheduled-task and autorun persistence, and process injection into legitimate Windows processes. SPINNER supported host reconnaissance, command execution, self-update, and exfiltration-oriented tasking, while earlier related variants also supported file enumeration, file manipulation, and theft of data from compromised systems. The malware incorporated anti-analysis and defense-evasion measures including dynamic API resolution, control-flow flattening, opaque predicates, and multi-stage encrypted loading. Overall, Twisted Panda represents a targeted Chinese espionage operation against Russian and Belarusian defense-related research entities.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
32 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chinese state-sponsored espionage campaign targeting Russian defense-related research institutes and a Belarusian research facility using phishing emails with sanctions- and bioweapon-themed lures, malicious documents, macros, and the Spinner backdoor.
Twisted Panda is reportedly a new threat group from China launching collection campaigns against Russian state-owned defense institutes.
Chinese espionage campaign targeting Russian defense research institutes and possibly a Belarusian research entity using sanctions- and Ukraine-war-themed spear-phishing, DLL sideloading, multi-layer in-memory loaders, and the SPINNER backdoor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.