Forensia CTI Core

Profile

PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.

MITRE ATT&CK ↗

Techniques

2 ATT&CK techniques attributed to this actor.

T1078 Valid Accounts T1588.002 Tool

Software

5 malware/tools attributed to this actor.

MimikatzgsecdumpLuridPoisonIvygh0st RAT

Related corpus activity

1,284 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to PittyTiger.

Indicator	Type	Family	Sev	Src
cve-2017-17215	cve	—	85	2
cve-2026-4368	cve	ransomware	85	1
cve-2026-22584	cve	—	85	2
cve-2025-66478	cve	—	85	2
cve-2025-68670	cve	—	85	2
cve-2024-1781	cve	—	85	1
cve-2018-8007	cve	—	85	1
cve-2016-0638	cve	phishing	85	1
cve-2025-0921	cve	—	85	2
cve-2025-23304	cve	—	85	2
9eaa577c8ba71646928c1c34c3145536b0498f65f26060a6ba00744bcef57644	sha256	phishing	80	1
6c700ca4e6d917c7aa9d964e98604a0349d9b8b4673df96a3f73a3d2d042635a	hash	—	80	2
2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98	sha256	phishing	80	1
f1551d3e5d144eef4e70a29dd3dc52fb22459d1f	hash	—	80	2
d78f64551d1b31a31e5998e442f0debd458e011e05019b3951d9ddde997f8384	hash	—	80	2
38353f95fff270f4e3a9d7add8c64666020dd668ce66e15969a736ec48cadc59	sha256	phishing	80	1
78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981	hash	supply_chain	80	1
681075027553546c119ec447eb8df84633dcffce	hash	—	80	3
52fda5c1b9704544f32ee98d9060e689	hash	ransomware	80	2
873f1277a42de5c82f869459e7fb7c94554a642b	hash	—	80	3
479ae5fd7274439ddfa27bc03298ebfdfc5ff17f6412acccf74d4dbd90d94218	sha256	phishing	80	1
f4d77958a12a0778283d3e679b24b18f82e332c4	hash	—	80	3
b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b	sha256	—	80	2
9c44bc9373377831c45dd0ac2661a28e	hash	—	80	3
3b6cb20891bce8602ce669187754871e402a1782031ef8b032cd007e3894bc5d	hash	—	80	2
6a69ea2ce3fea0ebfd7a32a1dfc4251bd4d7d8a4fbd44aaa47b82290d0414a9f	hash	—	80	2
2654c08491a0f7c4a3dfc6282de5638b	hash	—	80	3
01e3dce00ea45829bd9f6a583004976ac63973a0	hash	cryptojacking	80	1
123e80a34508c4dede7cc70e76931fcc	hash	—	80	3
686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4	sha256	ransomware	80	1

Showing the top 30 by severity of 1,284.