🇨🇳

GOBLIN PANDA

APT Group Information theft and espionage 4 zero-day CVEs ETDA ✓

Also Known As 2 names

Cycldek Conimes

Target Countries 9

Countries highlighted in red

Indonesia India Cambodia Myanmar Malaysia Philippines Thailand United States Vietnam

Sectors Targeted

Energy Defense Government

Details

Origin 🇨🇳 CN

Last Updated 07 Feb 2026

MITRE ATT&CK 8

T1036 - Masquerading T1055 - Process Injection T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1134 - Access Token Manipulation T1190 - Exploit Public-Facing Application T1505 - Server Software Component T1530 - Data from Cloud Storage Object

Related Zero-Days 4

CVE-2024-12356 CVE-2025-14847 CVE-2025-55182 CVE-2025-59287

Known Names 4 entries

Goblin Panda CrowdStrike

Cycldek Kaspersky

Conimes Anomali

1937CN ?

Observed Target Countries 10

Based on ETDA data — countries highlighted in red

Cambodia India Indonesia Laos Malaysia Myanmar Philippines Thailand USA Vietnam

Description

(CrowdStrike) CrowdStrike first observed Goblin Panda activity in September 2013 when indicators of its activity were discovered on the network of a technology company operating in multiple sectors. Malware variants primarily used by this actor include PlugX and HttpTunnel. This actor focuses a significant amount of its targeting activity on entities in Southeast Asia, particularly Vietnam. Heavy activity was observed in the late spring and early summer of 2014 when tensions between China and other Southeast Asian nations were high, due to conflict over territory in the South China Sea. Goblin Panda targets have been primarily observed in the defense, energy, and government sectors.

Tools Used 21

8.t Dropper BlueCore BrowsingHistoryView ChromePass CoreLoader DropPhone FoundCore HDoor HTTPTunnel JsonCookies nbtscan NewCore RAT PlugX ProcDump PsExec QCRat RedCore Sisfader USBCulprit ZeGhost Living off the Land

Operations 4

2016-07 A group identifying as Chinese hackers has attacked digital signage screens, overhead announcement systems and airline systems at airports across Vietnam. https://www.infosecurity-magazine.com/news/chinese-hackers-attack-airports/

2017-09 Recently, FortiGuard Labs came across several malicious documents that exploit the vulnerability CVE-2012-0158. https://www.fortinet.com/blog/threat-research/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations

2018 Attacks have been witnessed in government organizations across several Southeast Asian countries, namely Vietnam, Thailand and Laos, using a variety of tools and new TTPs. https://securelist.com/cycldek-bridging-the-air-gap/97157/

2020-06 The leap of a Cycldek-related threat actor https://securelist.com/the-leap-of-a-cycldek-related-threat-actor/101243/

Reports & References 1

https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-august-goblin-panda/

ETDA Profile

Goblin Panda, Cycldek, Conimes

Origin

China

First Seen 2013

Motivation

Information theft and espionage

View on ETDA APT Groups ↗