LIMINAL PANDA: China’s Emerging Espionage Threat in the Semiconductor and Technology Sectors

Liminal Panda is a suspected China-nexus cyber-espionage group. It began operating around 2020. Public reporting links it to attacks on telecommunications providers in South Asia and Africa. This post also describes it as targeting technology and defense organizations. It uses phishing, cloud identity abuse and tools such as PlugX and ShadowPad.

Introduction

LIMINAL PANDA is a suspected China-nexus cyber-espionage actor. It has recently emerged as an active player in the global threat landscape. The group began operating around 2020.

It collects intelligence on high-value targets in East Asia, Southeast Asia, and Western nations. These targets do research and development of advanced technologies, including semiconductors, defense technologies, and telecommunications.

LIMINAL PANDA is not yet as well known as APT41 or Mustang Panda. But its skills are growing fast. It is mixing older criminal-style phishing with advanced cloud exploitation and supply chain compromise.

In many ways, LIMINAL PANDA’s operations reflect China’s long-term strategy. That strategy is to target and acquire key technology and defense knowledge from overseas sources.

The group targets chip and semiconductor development and artificial intelligence (AI) research. This supports Beijing’s long-term plan to dominate these markets through initiatives such as “Made in China 2025.”

The group’s campaigns also suggest a growing focus on intellectual property compromise. They also show investment in strategic (defense) espionage, to compete with peer and near-peer nations in technology and geopolitical leverage.

Who Is Liminal Panda and What Motivates It?

The attribution strongly suggests sponsorship, or at a minimum considerable tolerance, from the Chinese state. The group’s targeting method and tool overlaps also seem to fit established Chinese espionage clusters, especially Earth Lusca, Mustang Panda, and RedHotel.

Analysts assess with moderate confidence that some parts of LIMINAL PANDA work on behalf of a regional bureau of China’s Ministry of State Security (MSS).

These are the motivations for LIMINAL PANDA’s campaigns:

• Strategic Technology Acquisition: Theft of semiconductor designs, data on semiconductor manufacturing, and research on advanced materials.
• Defense and Intelligence Collection: Targeting information on military research and development (R&D), dual-use technologies, and defense procurement activities.
• Regional Political Monitoring: An aim to gather intelligence on security collaboration and political relations about Taiwan and the Western allies in the Indo-Pacific region.

LIMINAL PANDA’s goals in the semiconductor and artificial intelligence (AI) sectors clearly match China’s wider industrial and military modernization goals.

What Tactics, Techniques, and Procedures (TTPs) Does the Group Use?

LIMINAL PANDA’s TTPs show the marks of modern Chinese cyber-espionage development. They are long-lasting and stealthy, and they use legitimate services to hide from detection.

The group shows a clear progression from spearphishing to more advanced exploitation of cloud identity and supply chain compromise.

1. Initial Access

LIMINAL PANDA mainly gains initial access through targeted phishing campaigns. These pose as technology vendors or research associates.

The group often sends malicious PDF or ZIP files with dropper code. These deploy variants of PlugX or ShadowPad malware.

The group is also seen exploiting vulnerable VPN and Web servers. It also compromises cloud environments and uses stolen authentication tokens.

2. Persistence and Privilege Escalation

After gaining access, LIMINAL PANDA keeps persistence with scheduled tasks, registry modification, and exploiting cloud permissions.

Recent activity in 2024-2025 has been observed creating malicious Azure AD applications and service principals. These keep access going without relying on malware footprints.

The group’s tactics show a strong preference for persistence tied to identity.

3. Command and Control (C2)

The C2 communications use encrypted HTTPS. They sometimes use cloud services (Dropbox, OneDrive, Alibaba Cloud Object Storage).

Mixing malicious traffic with legitimate traffic adds layers of obfuscation. It helps the actor stay persistent for months.

4. Malware and Tools

This actor uses both custom and publicly available toolsets. It has used a number of well known tools, including:

• PlugX: A framework built for Chinese espionage campaigns. It is often used in this actor’s tools. It is customized for resilience and lateral movement.
• ShadowPad: A modular backdoor used by actors related to MSS. It often uses encrypted C2 and plugin-based reporting functions. 
• Custom Loaders: Loaders that drop secondary payloads and hide malicious code.
• Legitimate Remain Tools: AnyDesk, Ammyy Admin, and TeamViewer have all been abused to gain remote access and steal files.

5. Exfiltration and Evasion

LIMINAL PANDA uses cloud APIs to exfiltrate data, often packaged as encrypted archives.

This actor also routinely signs malicious binaries with stolen client certificates or self-signed certificates. This helps it stay undetected (i.e., bypass antivirus detection).

It will also regularly clear logs to cover its operational tracks.

Notable Operations

LIMINAL PANDA’s track record shows growing technical skill as well as a wider geographic scope:

• 2022 – East Asia Tech Breach: Targeted technology and manufacturing businesses in Taiwan and Japan. This campaign used PlugX and Cobalt Strike for lateral movement. It targeted semiconductor fabrication data.
• 2023 – Research Institute Intrusions: Phishing intrusions against defense research organizations in Singapore and South Korea. Stolen documents showed the actor’s interest in both radar; propulsion technologies.
• 2024 – Cloud Credential Abuse: The actor victimized semiconductor suppliers in Europe. It used compromised Microsoft 365 accounts and OAuth tokens to keep access for several months.
• 2025 – Strategic Espionage Operations: Launched multi-vector attacks against Western AI research; chip design firms. It compromised outdated cloud/e-email authentication protocols. It also used phishing attempts.

The success of these operations shows the actor can adapt quickly. It keeps exploiting human and technical weaknesses while making little operational noise.

Evolution and Tradecraft

LIMINAL PANDA’s evolution mirrors the wider modernization of Chinese cyber espionage. In its early days, the group used commodity malware and traditional phishing.

But between 2023-2025, analysts observed a substantive shift towards:

• Cloud-Native Persistence: The actor uses cloud application tokens and Application Programming Interfaces [APIs] for persistent and ongoing access.
• Supply Chain Infiltration: The actor compromises a third-party IT service provider that serves the targeted industry.
• Operational Segmentation: Initial access, data collection and later exfiltration used clearly separate infrastructures. This hides attribution.
• Infrastructure Recycling: The adversary swaps domains and C2 [command-and-control] nodes every few months. It sometimes uses ancient web services.

These developments put LIMINAL PANDA into a new generation of Chinese spy units. They prioritize stealth and long-term data acquisition vs. quick exploitation.

The approaches were similar to Earth Lusca and RedGolf, but leaned heavily toward semiconductor and technology research.

Strategic Impact and Defensive Takeaways

The strategic implications of LIMINAL PANDA’s activity are significant. Semiconductor technology will play a central role in future defense systems, further AI innovations, and economic competition.

In this targeted sector, the group advances Beijing’s strategic goal of reducing imports and achieving technological self-sufficiency.

Impact Summary:

• Intellectual Property Loss: Loss of proprietary chip design and R&D data could weaken Western and East Asian competitiveness.
• Supply Chain Risk: Compromise of trusted vendors brings systemic vulnerabilities.
• National Security Threat: Access to dual-use technologies could help both commercial and military uses in China.

How Can Organizations Defend Against This Actor?

1. Identity Security: Set up conditional access policies. Enforce MFA across all cloud accounts. Monitor for anomalous OAuth token grants.
2. Email and Endpoint Protection: Use sandboxing. Disarm and reconstruct attachments. Enforce strict email authentication.
3. Threat Hunting: Review logs often for anomalous or unusual PowerShell, SMB and RDP activity. Look out for otherwise legitimate tools being abused for remote access.
4. Supply Chain Assurance: Assess third-party vendors on their cloud configuration and third-party identity security hygiene.
5. Information Sharing: Use regional and sectoral intelligence sharing to spot infrastructure overlaps and emerging TTPs.

Conclusion

LIMINAL PANDA embodies the next generation of nimble, cloud-native Chinese espionage operations. While they are alimited long legacy groups such as APT10 or APT41, the ENC have been able to quickly embrace some of the latest techniques.

These exploit both cloud identity systems and the human layer of security. By targeting semiconductors, AI, and defense technologies, the ENC directly supports China’s strategic industrial ambitions and military modernization.

As we look to 2025, LIMINAL PANDA’s development points to an increased risk in cyber-espionage activities. These involve targeting both the advanced technology ecosystem.

Their activity skims the surface of a future where cloud compromise, identify abuse, and supply chain intrusion replaces traditional malware as an espionage model.

Defending against these threats will not only require robust technical controls. It will also need an advanced understanding of the strategic motivations driving state-sponsored cyber operations in the 21st century.

You can download and review the sheet for all the details!