PittyTiger · APTtrail

On this page

Attribution

Upstream trail: PITTYTIGER

Take the data

# everything, with sources
curl -sL https://trilwu.github.io/apttrail/by-group/G0011.json

# domains, one per line
curl -sL https://trilwu.github.io/apttrail/by-group/G0011-domain.txt

G0011.json · G0011-domain.txt

Overview 16 indicators

PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.

domain

16

G0011-domain.txt

Techniques 2 ATT&CK

Open in ATT&CK Navigator → or download the layer (2 techniques, layer 4.5)

Software 5

Principal sources 4 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 16 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

2021-12-31 1 domain5 yrs ago

apt.thaicert.or.th/cgi-bin/showcard.cgi?g=PittyTiger%2C%20… · paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2… · github.com/rsmudge/Malleable-C2-Profiles/blob/mast…

newb02.skypetm.com.tw
2021-12-30 12 domain5 yrs ago

apt.thaicert.or.th/cgi-bin/showcard.cgi?g=PittyTiger%2C%20… · paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2… · github.com/rsmudge/Malleable-C2-Profiles/blob/mast…

acers.com.tw

dopodo.com.tw

foxcom.com.tw

helosaf.com.tw

kimoo.com.tw

lightening.com.tw

paccfic.com

seed01.com.tw

stareastnet.com.tw

symantecs.com.tw

trendmicro.org.tw

trendmicroup.com
2021-12-30 1 domain5 yrs ago

virustotal.com/gui/file/388d46cd5bed2c08c2bd90fa0cec35…

killerhost.skypetm.com.tw
2019-10-05 2 domain7 yrs ago

apt.thaicert.or.th/cgi-bin/showcard.cgi?g=PittyTiger%2C%20… · paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2… · github.com/rsmudge/Malleable-C2-Profiles/blob/mast…

avstore.com.tw

skypetm.com.tw

Further reading 7