PittyTiger

MITRE ATT&CK: G0011 View on attack.mitre.org

Aliases: PITTY PANDA, Temp.Pittytiger, PittyTiger

First seen: 2017-01-01 00:00:00
Origin: CN
Primary motivation: espionage
Sophistication: intermediate
Resource level: government
Actor type: nation-state
Last IoC activity: 2026-07-12 01:01:16
Profile updated: 2026-07-07 12:31:37

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:hk country_code:tw

Context

PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.

Detection coverage

10 YARA rules
64 Sigma rules

Malware & tools used

Tool (attack-pattern)
Valid Accounts (attack-pattern)
Lurid (malware)
gh0st RAT (malware)
Mimikatz (malware)
gsecdump (malware)
PoisonIvy (malware)

Reports & references

Mandiant — Apt Groups (report)
blog.airbuscybersecurity.com — The Eye Of The Tiger2 (report)
blog.cassidiancybersecurity.com — The Eye Of The Tiger2 (report)
paper.seebug.org — Pitty Tiger Final Report (report)
McAfee — Targeted Attacks On French Company Exploit Multiple Word Vulnerabilities (report)
Mandiant — Spy Of The Tiger (report)
MITRE ATT&CK — G0011 (report)
airbus-cyber-security.com — The Eye Of The Tiger (report)

External references