Horde Panda
| Actor Type | Nation State |
|---|---|
| Attributed to Nation | China |
HORDE PANDA is a China-based intrusion set tracked by CrowdStrike with a likely intelligence collection mission. Active since at least mid-2023, HORDE PANDA primarily focuses on entities in the telecommunications sector in South Asia. The group has been observed using malware families including KEYPLUG, ShadowPad, Proxip, and PlugX which are commonly associated with China based threat actors. Their operations involve using multiple compromised identities to embed themselves deeper into networks and move laterally, often gaining initial access through VPN IP ranges.
Between late June 2023 and early August 2023, CrowdStrike detected suspicious activity linked to HORDE PANDA at a South Asian telecommunications provider. The adversary attempted to perform a DCSync attack, later establishing persistence using implants such as LuaPlug and KEYPLUG.
Cyber Threat Graph Context
Explore how this Intrusion Set relates to the wider threat graph