Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

OSINT - #EmissaryPanda #APT older sample (2018)

The provided information pertains to an OSINT report on an older sample (2018) linked to the Emissary Panda Advanced Persistent Threat (APT), also known as Threat Group-3390 or LuckyMouse. Emissary Panda is a known Chinese state-sponsored threat actor group that has been active since at least 2013, primarily targeting government entities, think tanks, and critical infrastructure with espionage objectives. This specific entry references a campaign sample from 2018, indicating historical activity rather than a newly discovered vulnerability or exploit. The data is sourced from CIRCL and categorized under the MITRE ATT&CK intrusion set for Threat Group-3390. The severity is marked as low, with no known exploits in the wild and no specific affected software versions or vulnerabilities detailed. The threat level is indicated as 3 on an unspecified scale, and the certainty of the OSINT source is moderate (50%). No technical indicators or detailed tactics, techniques, and procedures (TTPs) are provided in this report. Overall, this entry serves as an intelligence note on the existence and historical activity of Emissary Panda rather than describing an active or emergent security threat or vulnerability.

Detailed information about OSINT - #EmissaryPanda #APT older sample (2018). Get real-time updates, technical details, and mitigation strategies.

OSINT - #EmissaryPanda #APT older sample (2018) - Live Threat Intelligence - Threat Radar | OffSeq.com

Emissary Panda Attacks Middle East Government Sharepoint Servers by Palo Alto Unit42

The threat known as Emissary Panda, also identified as Threat Group-3390 or LuckyMouse, is a sophisticated cyber espionage actor primarily targeting government entities in the Middle East. This campaign, as reported by Palo Alto Networks Unit42 and sourced from CIRCL, specifically focuses on compromising Microsoft SharePoint servers used by government organizations. SharePoint servers are critical collaboration platforms that often contain sensitive documents and internal communications, making them high-value targets for espionage. The attack methodology likely involves exploiting vulnerabilities or misconfigurations in SharePoint deployments to gain unauthorized access, establish persistence, and exfiltrate sensitive data. Although no specific affected versions or known exploits in the wild are documented, the high severity rating and the nature of the threat actor suggest advanced tactics, techniques, and procedures (TTPs) consistent with state-sponsored intrusion sets. The campaign's focus on Middle Eastern government SharePoint servers indicates a targeted approach aimed at intelligence gathering and possibly long-term surveillance. The lack of publicly disclosed technical details or indicators of compromise (IOCs) limits the ability to fully dissect the attack vectors, but the association with Emissary Panda implies the use of spear-phishing, zero-day exploits, or supply chain compromises as potential initial access vectors. The threat level and analysis scores indicate a credible and well-analyzed campaign, emphasizing the need for vigilance among organizations operating similar infrastructure.

Detailed information about Emissary Panda Attacks Middle East Government Sharepoint Servers by Palo Alto Unit42. Get real-time updates, technical details, and m

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:threat-actor="luckymouse"'

Filter Threats

Threats Tagged 'misp-galaxy:threat-actor="luckymouse"'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility