Eloquent Panda

Executive Summary

Eloquent Panda is a nation-state threat actor primarily focused on espionage activities targeting the education sector. Their operations have been active since early 2023 and involve sophisticated tactics such as spear-phishing attacks using malicious Office documents, with legitimate collaboration tools used for command and control (C2). Despite their operational persistence, Eloquent Panda exhibits patient campaign behavior, suggesting a focus on long-term objectives rather than rapid impact.

Goals & Targeting

Eloquent Panda's primary objective appears to be espionage, with a focus on extracting sensitive information from educational institutions—likely targeting research data, intellectual property, and communications. Their targeting of the education sector suggests an interest in higher education facilities that may house valuable research or partnerships with other sectors. This aligns with common nation-state actor strategies seeking to enhance their technological or military capabilities through information acquisition.

Eloquent Panda is suspected to be a state-sponsored actor, though specific origin attribution remains unclear. Their modus operandi involves meticulously crafted phishing campaigns that leverage social engineering tactics to gain initial access to targets within the education sector. The group's use of malicious Office document attachments indicates a preference for common yet effective techniques to deliver payloads. Eloquent Panda employs collaboration tools such as Slack or Trello for C2, allowing them to maintain persistence under the radar while exfiltrating sensitive information over extended periods. These behaviors suggest a strategic focus on intelligence gathering rather than immediate destruction or disruption.

Key Capabilities

• Spear-phishing campaigns
• Malicious Office document attachments
• Legitimate collaboration tools for C2

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Eloquent Panda's campaigns are characterized by a patient approach, with extended dwell time suggesting a focus on stealth and long-term objectives. Their use of spear-phishing vectors indicates an attempt to target specific individuals within their selected sector. Notable past operations include the deployment of custom malware linked to early 2023 activities and ongoing campaigns leveraging Office document exploits for payload delivery.

IOC Patterns

• Spear-phishing emails with malicious Office documents
• C2 communication via legitimate collaboration tools

Recommended Actions

• Implement advanced email filtering solutions to detect and block spear-phishing attempts
• Conduct regular user training on phishing awareness
• Monitor for unusual activity in collaboration platforms commonly used by the organization
• Enhance endpoint detection and response capabilities to identify malicious Office document payloads

Suggested Tags