Threat Actor Profile
Turbine Panda
Turbine Panda, also known as APT26, is a state-sponsored Chinese threat actor affiliated with the Jiangsu Bureau of the Ministry of State Security (JSSD). First observed around 2010, this sophisticated group notably employs tactics like espionage and supply chain compromises. Their primary focus includes intellectual property theft and economic espionage targeting the aerospace, defense, and energy sectors.
Threat Actor Profile
Turbine Panda
Country of Origin
Turbine Panda is attributed to China. Numerous reports tie the group’s activities to the Jiangsu Bureau of the Ministry of State Security (MSS), emphasizing its state-backed origins.
Members
The exact number of individuals involved in Turbine Panda is unclear. Still, the group operates under several aliases, including Shell Crew, WebMasters, and KungFu Kittens, which highlights their diverse and adaptive operational methods.
Leadership
Specific leadership details about Turbine Panda remain unknown. However, their operations' scale and complexity suggest coordination within a structured intelligence apparatus like China’s MSS.
Turbine Panda TTPs
Tactics
The group primarily engages in intellectual property theft and espionage, targeting sensitive industries such as aerospace, defense, and critical infrastructure. They are notorious for compromising supply chains to infiltrate high-value targets.
Techniques
Turbine Panda employs strategic web compromises (watering-hole attacks), phishing, and the use of insiders to deliver malware, such as PlugX, Sakula, and the Winnti backdoor.
Procedures
Their operations often involve planting malware via compromised websites, phishing campaigns, or recruiting insiders to deploy malicious tools directly into target systems. They show a particular interest in infiltrating aerospace and defense supply chains, further enabling their espionage objectives
Want to Shut Down Threats Before They Start?
Notable Cyberattacks
Between 2010 and 2015, Turbine Panda carried out a widespread campaign to compromise aerospace firms involved in the supply chain for the C919 aircraft. These operations included supply chain intrusions, malware deployment, and the exfiltration of sensitive data. Additionally, they utilized malicious tools like PlugX and Sakula to infiltrate systems.
Law Enforcement & Arrests
To date, there have been limited public reports of arrests or direct law enforcement actions addressing Turbine Panda’s activities. Their state-sponsored status complicates accountability due to their ties to China’s MSS.
How to Defend Against Turbine Panda
Monitor for malware signatures like PlugX, Sakula, and Winnti using EDR solutions.
Strengthen web server security to detect watering-hole compromises or anomalous traffic patterns.
Secure supply chains by implementing network segmentation and vetting contractors and vendors.
Implement insider threat programs to detect unusual access or activity involving removable media.
Strengthen patch management to address vulnerabilities commonly exploited by the group.
Leverage threat intelligence sharing to identify IoCs and anticipate potential campaigns.
References
Detect, Respond, Protect
See how the global Huntress SOC can augment your team
with 24/7 coverage and unmatched human expertise.
Start your free trial today.
