Putter Panda

APT2 G0024 MSUpdater

▲ High Threat

Ongoing Aerospace Espionage

Origin China

Sponsor People's Liberation Army (PLA) Unit 61486

Motivation Strategic espionage and theft of aerospace and defense intellectual property

Target Sectors

Aerospace Defense Industrial Base Government Satellite Communications Research Institutions

Spear-phishing via targeted email attacks

Use of malicious macros in Adobe Reader and Microsoft Office documents

Deployment of custom Remote Access Trojans (RATs) such as 3PARA and 4H RAT

Utilization of MSUpdater and pngdowner for persistence and payload delivery

C2 communication via HTTP/S

CISA Advisories ↗

Attacks and Vulnerabilities 2026-07-03

Attacks and Vulnerabilities 2026-07-05

Attacks and Vulnerabilities 2026-06-19

Strategies and Tactics 2026-05-28