Threadlinqs IntelligenceStart free

Threat actorChinaTracked since 2026-02

WARP PANDA

As of 2026-10-29, WARP PANDA is a China-nexus threat actor tracked by Threadlinqs Intelligence across 6 threats spanning apt, malware, vulnerability. ATT&CK coverage spans 81 techniques across 15 tactics in 6 of 6 tracked threats. Most-observed techniques: T1190 (Exploit Public-Facing Application), T1572 (Protocol Tunneling), T1027 (Obfuscated Files or Information).

Tracked threats
65 critical · 1 high
First seen
2026-02-21
Last seen
2026-10-29
ATT&CK techniques
81across 6 of 6 threats
Related CVEs
5Referenced by its activity
Attribution
ChinaNation or origin
Nation: China · 6 tracked threat(s) · Categories: APT, MALWARE, VULNERABILITY, ZERO_DAY

Activity timeline

WARP PANDA appears in 6 tracked threats between and ; the busiest month was 2026-04 with 2 reports.

ATT&CK techniques observed

81 techniques observed across 6 of 6 tracked threats · Stealth (formerly Defense Evasion) (12), Command and Control (10), Persistence (9), Collection (7), Credential Access (7), Lateral Movement (7)
  • T1190 Exploit Public-Facing Application — Initial Accessobserved in 6 of 6 tracked threats
  • T1572 Protocol Tunneling — Command and Controlobserved in 6 of 6 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 4 of 6 tracked threats
  • T1059 Command and Scripting Interpreter — Executionobserved in 4 of 6 tracked threats
  • T1071 Application Layer Protocol — Command and Controlobserved in 4 of 6 tracked threats
  • T1090 Proxy — Command and Controlobserved in 4 of 6 tracked threats
  • T1505 Server Software Component — Persistenceobserved in 4 of 6 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 3 of 6 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 3 of 6 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 3 of 6 tracked threats
  • T1068 Exploitation for Privilege Escalation — Privilege Escalationobserved in 3 of 6 tracked threats
  • T1070 Indicator Removal — Stealth (formerly Defense Evasion)observed in 3 of 6 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 3 of 6 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 3 of 6 tracked threats
  • T1003.003 OS Credential Dumping: NTDS — Credential Accessobserved in 2 of 6 tracked threats

Tracked threats

Related CVEs

5 CVEs referenced by tracked WARP PANDA activity