A Chinese-linked hacking group known as Murky Panda has been discovered using an unusual method to infiltrate US businesses.
The hackers are abusing the trust companies place in their cloud service providers, giving them access to sensitive files and enabling long-term espionage activities.
CrowdStrike Uncovers Espionage Campaign
Security experts at CrowdStrike revealed that since 2023, at least two incidents have been linked to Murky Panda.
The group reportedly exploited zero-day flaws in SaaS providers’ cloud environments, using this entry point to study their victims’ system logic.
This allowed them to move laterally into downstream customers and extend their spying capabilities.
A Unique Supply Chain Attack
Unlike traditional cyberattacks, Murky Panda’s approach uses a third-party cloud provider as the gateway.
CrowdStrike explained that this rare tactic is less monitored compared to common methods such as compromised cloud accounts or exposed applications, making it particularly effective.
Links to Silk Typhoon Suspected
Researchers noted that Murky Panda’s tactics closely resemble those of Silk Typhoon, a known Chinese state-sponsored hacking group.
While direct attribution remains uncertain, analysts believe the group could be Silk Typhoon itself, a partner operation, or even a copycat organization.
Targets Across Multiple Sectors
Murky Panda’s main focus appears to be intelligence-gathering.
The group has targeted government agencies, technology firms, academic institutions, legal practices, and professional services, with victims primarily located in North America.
Exploiting Known Vulnerabilities
In addition to zero-day exploits, Murky Panda has been seen leveraging CVE-2023-3519, a Citrix NetScaler vulnerability previously used by ransomware operators.
The group has also been linked to attacks on small office and home office (SOHO) devices, expanding its range of entry points.
Espionage Remains the Core Objective
Despite the evolving tools and techniques, researchers emphasize that Murky Panda’s operations remain focused on cyber-espionage rather than financial gain.
Its activity highlights the growing risks tied to cloud service providers and the need for stronger monitoring of supply chain security.