{
	"id": "1990dce0-4935-4f67-932c-ea78f871e5a2",
	"created_at": "2026-04-06T00:11:00.98971Z",
	"updated_at": "2026-04-10T13:12:40.90325Z",
	"deleted_at": null,
	"sha1_hash": "250df8f2d97213b9541c891be0a2ba56f601e9bd",
	"title": "Anchor Panda, APT 14 - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51517,
	"plain_text": "Anchor Panda, APT 14 - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-05 13:24:28 UTC\nHome \u003e List all groups \u003e Anchor Panda, APT 14\n APT group: Anchor Panda, APT 14\nNames\nAnchor Panda (CrowdStrike)\nAPT 14 (Mandiant)\nAluminum (Microsoft)\nQAZTeam (?)\nCountry China\nSponsor State-sponsored, PLA Navy\nMotivation Information theft and espionage\nFirst seen 2012\nDescription\n(CrowdStrike) Anchor Panda is an adversary that CrowdStrike has tracked extensively over\nthe last year targeting both civilian and military maritime operations in the green/brown water\nregions primarily in the area of operations of the South Sea Fleet of the PLA Navy. In addition\nto maritime operations in this region, Anchor Panda also heavily targeted western companies\nin the US, Germany, Sweden, the UK, and Australia, and other countries involved in maritime\nsatellite systems, aerospace companies, and defense contractors.\nNot surprisingly, embassies and diplomatic missions in the region, foreign intelligence\nservices, and foreign governments with space programs were also targeted.\nObserved\nSectors: Aerospace, Defense, Engineering, Government, Industrial and NGOs in the\ngreen/brown water regions primarily in the area of operations of the South Sea Fleet of the\nPLA Navy.\nCountries: Australia, Germany, Sweden, UK, USA and others.\nTools used Gh0st RAT, Poison Ivy, Torn RAT.\nInformation Last change to this card: 14 April 2020\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=7ba53b4a-91c1-4caa-83f9-2885fe30e9ed\nPage 1 of 2\n\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=7ba53b4a-91c1-4caa-83f9-2885fe30e9ed\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=7ba53b4a-91c1-4caa-83f9-2885fe30e9ed\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=7ba53b4a-91c1-4caa-83f9-2885fe30e9ed"
	],
	"report_names": [
		"showcard.cgi?u=7ba53b4a-91c1-4caa-83f9-2885fe30e9ed"
	],
	"threat_actors": [
		{
			"id": "c8aefee7-fb57-409b-857e-23e986cb4a56",
			"created_at": "2023-01-06T13:46:38.285223Z",
			"updated_at": "2026-04-10T02:00:02.910756Z",
			"deleted_at": null,
			"main_name": "APT18",
			"aliases": [
				"SCANDIUM",
				"PLA Navy",
				"Wekby",
				"G0026",
				"Satin Typhoon",
				"DYNAMITE PANDA",
				"TG-0416"
			],
			"source_name": "MISPGALAXY:APT18",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "2ac8fb39-1ad4-407c-bf51-249751a575ba",
			"created_at": "2023-01-06T13:46:38.337728Z",
			"updated_at": "2026-04-10T02:00:02.933527Z",
			"deleted_at": null,
			"main_name": "SAMURAI PANDA",
			"aliases": [
				"PLA Navy",
				"Wisp Team"
			],
			"source_name": "MISPGALAXY:SAMURAI PANDA",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c6604303-a1c8-4e59-ba12-5da5c0bc6877",
			"created_at": "2023-01-06T13:46:38.312359Z",
			"updated_at": "2026-04-10T02:00:02.923025Z",
			"deleted_at": null,
			"main_name": "APT14",
			"aliases": [
				"ANCHOR PANDA",
				"QAZTeam"
			],
			"source_name": "MISPGALAXY:APT14",
			"tools": [
				"Backdoor.Win32.PoisonIvy",
				"Gen:Trojan.Heur.PT",
				"Torn RAT",
				"Anchor Panda",
				"Gh0st Rat",
				"Gh0stRat, GhostRat",
				"Poison Ivy"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d4ac28d1-66eb-4f2d-9f9b-a72394349fd0",
			"created_at": "2023-01-06T13:46:38.667954Z",
			"updated_at": "2026-04-10T02:00:03.061447Z",
			"deleted_at": null,
			"main_name": "APT4",
			"aliases": [
				"PLA Navy",
				"MAVERICK PANDA",
				"BRONZE EDISON",
				"SODIUM",
				"Salmon Typhoon"
			],
			"source_name": "MISPGALAXY:APT4",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "25a38dea-d23b-479b-9548-024e955b8964",
			"created_at": "2022-10-25T16:07:23.305911Z",
			"updated_at": "2026-04-10T02:00:04.533448Z",
			"deleted_at": null,
			"main_name": "Anchor Panda",
			"aliases": [
				"APT 14",
				"Anchor Panda",
				"QAZTeam"
			],
			"source_name": "ETDA:Anchor Panda",
			"tools": [
				"AngryRebel",
				"Chymine",
				"Darkmoon",
				"Farfli",
				"Gen:Trojan.Heur.PT",
				"Gh0st RAT",
				"Ghost RAT",
				"Moudour",
				"Mydoor",
				"PCRat",
				"Poison Ivy",
				"SPIVY",
				"Torn RAT",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434260,
	"ts_updated_at": 1775826760,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/250df8f2d97213b9541c891be0a2ba56f601e9bd.pdf",
		"text": "https://archive.orkl.eu/250df8f2d97213b9541c891be0a2ba56f601e9bd.txt",
		"img": "https://archive.orkl.eu/250df8f2d97213b9541c891be0a2ba56f601e9bd.jpg"
	}
}