Description
Pandora is a multistage kernel rootkit with backdoor functionality that the Threat Group-3390 intrusion set has used since at least 2020.
Stats
- First seen
- May 2022
- Last seen
- October 2026
MITRE ATT&CK techniques
13 techniques across 7 tactics.
Associated groups
Alert name variants
| Alert Name |
|---|
| Android.Dropper.Pandora |
| Android.Trojan.Pandora |
| ByteCode-MSIL.Backdoor.Pandora |
| Dropped:Generic.Ransom.Pandora.A.4CAD0303 |
| Generic.Ransom.Pandora.A.4CAD0303 |
| Generic.Ransom.Pandora.A.661D3739 |
| Generic.Ransom.Pandora.A.A42AD950 |
| Generic.Ransom.Pandora.A.F0864164 |
| Linux.Trojan.Pandora |
| Win32.Backdoor.Pandora |