admin@338

Executive Summary

admin@338, also known as Temper Panda and 338 Team, is a suspected China-based cyber threat group primarily motivated by espionage. This group has targeted defense, government, and financial sectors, utilizing tools like PoisonIvy RAT. Their TTPs include spear-phishing campaigns leveraging current events, making them a persistent and evolving threat.

Goals & Targeting

admin@338 targets sectors with strategic significance, focusing on defense and government for sensitive data. They also target financial institutions and think tanks involved in policy-making, suggesting an aim to influence economic strategies and gain political advantages through espionage.

admin@338 is a cyber espionage group known for targeting defense, government, and economic institutions. They have been active since at least 2015, with their most notable campaign being 'Umbrella Revolution.' Using tactics like spear-phishing with malicious attachments (T1566.001), they deploy tools such as PoisonIvy RAT and BUBBLEWRAP backdoor. Their ability to adapt TTPs indicates a sophisticated threat actor likely linked to state-sponsored activities.

Key Capabilities

• Spear-phishing with malicious attachments
• Use of RATs (e.g., PoisonIvy)
• Deployment of backdoors (BUBBLEWRAP, LOWBALL)
• System information discovery
• Network configuration discovery
• Local account management

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

admin@338's longest-known campaign, 'Umbrella Revolution,' occurred between 2015 and 2016. Their activities suggest a focus on long-term objectives with occasional high-profile operations, indicating persistence despite low media coverage post-2017.

IOC Patterns

• Spear-phishing emails referencing newsworthy events
• Malware dropped via malicious Office documents
• Establishment of C2 communication using legitimate channels
• Usage of known RATs and backdoors

Recommended Actions

• Implement robust email filtering to detect spear-phishing attempts.
• Monitor for MITRE ATT&CK techniques T1566.001 and T1059.003 in network traffic.
• Deploy endpoint detection and response (EDR) solutions for early threat identification.
• Conduct regular phishing simulation exercises to enhance employee awareness.

Suggested Tags