China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. This threat actor targets prodemocratic activists and organizations in Hong Kong, European and international financial institutions, and a U.S.-based think tank.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Admin338 |
| OSINT | Team338 |
| OSINT | MAGNESIUM |
| OSINT | admin@338 |
| OSINT | G0018 |
Sectors: Government, Private sector, Civil society, Activists, Trade, Finance, Political party
Victim countries: Hong Kong, United States
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names TEMPER PANDA, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to TEMPER PANDA. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.