Putter Panda

G0024 China Espionage MITRE ATT&CK →

Also known as: APT2 · MSUpdater

Overview

Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD).

Naming & attribution

Putter Panda is tracked under 3 names across the industry. It uses 4 documented ATT&CK techniques — more than 9% of the 174 groups tracked here.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
APT2	Gross, J. and Walter, J.
MSUpdater	Crowdstrike Global Intelligence Team
PUTTER PANDA	Crowdstrike Global Intelligence Team

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

TA2541 — 3 shared techniques (10% overlap)
TA505 — 3 shared techniques (9% overlap)
Tropic Trooper China — 3 shared techniques (7% overlap)
Leviathan China — 3 shared techniques (6% overlap)
Contagious Interview North Korea — 3 shared techniques (5% overlap)
TeamTNT — 3 shared techniques (5% overlap)

Malware families with current indicators

One family attributed to Putter Panda, carrying 4 indicators currently tracked from abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL. MITRE documents what a group does; this is what its tooling is doing now.

4h_rat 4 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Targets

Government · Private sector

Regions

U.S. satellite and aerospace sector

Capabilities

Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 4 techniques across 3 tactics

Tools & malware (4)

pngdowner · 3PARA RAT · 4H RAT · httpclient

Reporting (2)

Puttering into the Future — Gross, J. and Walter, J.
CrowdStrike Intelligence Report: Putter Panda — Crowdstrike Global Intelligence Team