Tick is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group appears to have close ties to the Chinese National University of Defense and Technology, which is possibly linked to the PLA. This threat actor targets organizations in the critical infrastructure, heavy industry, manufacturing, and international relations sectors for espionage purposes. The attacks appear to be centered on political, media, and engineering sectors. STALKER PANDA has been observed conducting targeted attacks against Japan, Taiwan, Hong Kong, and the United States.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Nian |
| OSINT | BRONZE BUTLER |
| OSINT | REDBALDKNIGHT |
| OSINT | STALKER PANDA |
| OSINT | G0060 |
| OSINT | Stalker Taurus |
| OSINT | PLA Unit 61419 |
| OSINT | Swirl Typhoon |
| OSINT | TEMP.Tick |
| OSINT | TICK CASTLE |
Sectors: Private sector, Infrastructure, Industrial, Manufacturing, Diplomacy, News - Media, Political party, Engineering
Victim countries: Japan, China, South Korea, Russian Federation
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Tick, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Tick. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.