{
  "aliases": [
    "msupdater"
  ],
  "attack_id": "G0024",
  "attack_name": "Putter Panda",
  "attack_url": "https://attack.mitre.org/groups/G0024/",
  "counts": {
    "domain": 5,
    "url": 3,
    "url_path": 2
  },
  "first_seen": {
    "domain": {
      "great.vssigma.com": "2022-04-10",
      "red.vssigma.com": "2022-04-10",
      "resell.siseau.com": "2022-04-10",
      "siseau.com": "2022-04-10",
      "vssigma.com": "2022-04-10"
    },
    "url": {
      "http://140.112.19.195": "2022-04-10",
      "mail.hfmforum.com/microsoft/errorpost/default/connect.aspx": "2022-04-10",
      "mail.hfmforum.com/microsoftupdate/getupdate/default.aspx": "2022-04-10"
    },
    "url_path": {
      "/microsoft/errorpost/default/connect.aspx": "2022-04-10",
      "/microsoftupdate/getupdate/default.aspx": "2022-04-10"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "url": {},
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2022-04-10",
    "latest": "2022-04-10"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "great.vssigma.com",
      "red.vssigma.com",
      "resell.siseau.com",
      "siseau.com",
      "vssigma.com"
    ],
    "url": [
      "http://140.112.19.195",
      "mail.hfmforum.com/microsoft/errorpost/default/connect.aspx",
      "mail.hfmforum.com/microsoftupdate/getupdate/default.aspx"
    ],
    "url_path": [
      "/microsoft/errorpost/default/connect.aspx",
      "/microsoftupdate/getupdate/default.aspx"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "PUTTERPANDA"
  ],
  "references": [
    "https://samples.vx-underground.org/APTs/2010/2010.09.06/Paper/MSUpdater%20Trojan.pdf",
    "https://www.virustotal.com/gui/file/2ab81ed10aa5f5f3443714924e4d89ae3050c1a30332a55c2cfae58851ae4ac1/detection",
    "https://www.virustotal.com/gui/file/452b1789b5f9c6acc390148048f923f40270a3c2800ce4e1a8b9cbc90aab49e5/detection",
    "https://www.virustotal.com/gui/file/6a237ffe0f7d84ffd9652662a2638a9b5212636b414ce15ea2e39204d2a24e7f/detection",
    "https://www.virustotal.com/gui/file/75d3c3875744196cedff55d179bc62412adeba5e769fbfc85b2b891ff32b4f9f/detection",
    "https://www.virustotal.com/gui/file/d8a976979d4eeaf7485249c49d4a31824638a49dac308c5114c113b4a3eed9c9/detection"
  ],
  "related": [],
  "slug": "G0024",
  "timeline": [
    {
      "counts": {
        "domain": 1,
        "url_path": 2
      },
      "first_seen": "2022-04-10",
      "indicators": {
        "domain": [
          "red.vssigma.com"
        ],
        "url_path": [
          "/microsoft/errorpost/default/connect.aspx",
          "/microsoftupdate/getupdate/default.aspx"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/452b1789b5f9c6acc390148048f923f40270a3c2800ce4e1a8b9cbc90aab49e5/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-04-10",
      "indicators": {
        "domain": [
          "great.vssigma.com",
          "vssigma.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/75d3c3875744196cedff55d179bc62412adeba5e769fbfc85b2b891ff32b4f9f/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-04-10",
      "indicators": {
        "domain": [
          "resell.siseau.com",
          "siseau.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/6a237ffe0f7d84ffd9652662a2638a9b5212636b414ce15ea2e39204d2a24e7f/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 2
      },
      "first_seen": "2022-04-10",
      "indicators": {
        "url": [
          "mail.hfmforum.com/microsoft/errorpost/default/connect.aspx",
          "mail.hfmforum.com/microsoftupdate/getupdate/default.aspx"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/2ab81ed10aa5f5f3443714924e4d89ae3050c1a30332a55c2cfae58851ae4ac1/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2022-04-10",
      "indicators": {
        "url": [
          "http://140.112.19.195"
        ]
      },
      "precision": "exact",
      "references": [
        "https://samples.vx-underground.org/APTs/2010/2010.09.06/Paper/MSUpdater%20Trojan.pdf",
        "https://www.virustotal.com/gui/file/d8a976979d4eeaf7485249c49d4a31824638a49dac308c5114c113b4a3eed9c9/detection"
      ],
      "total": 1
    }
  ]
}