Threat Intelligence Tarot
Vol. II · 84
China (MSS-affiliated)
★★★★★
risk 3/5
✦ The Sunken Dragon ✦
Aquatic Panda
BRONZE UNIVERSITY · DoubleAgent
TelecommunicationsTechnologyGovernmentAcademic institutions
Active since ~2020 · Espionage, Intelligence collection
The Sunken Dragon lies in the depths of unpatched infrastructure, rising only when a new vulnerability breaks the surface. Its patience is geological: it waits for the flaw that will open the gate.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Log4Shell exploitation campaign (December 2021)
- ◆Targeting of global telecom providers
- ◆Academic research institution breaches
- ◆Credential harvesting at enterprise scale
Defenses
- ▸Vulnerability management with SLA for critical CVEs under 48 hoursCIS Control 7 ↗
- ▸LSASS protection via Credential Guard on Windows endpointsCIS Control 10 ↗
- ▸PowerShell constrained language mode and script block loggingCIS Control 8 ↗
- ▸Web application firewall with virtual patching capabilityNIST CSF: PR.PT ↗
Reversed: Their Weakness
Aggressive patch management is its nemesis. Organizations that applied Log4Shell patches within 48 hours denied it its primary access vector. Timely vulnerability response eliminates its favored entry points.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.