TIARAS - PittyTiger

Threat Actor Profile

High APT

Description

PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.(Citation: Bizeul 2014)(Citation: Villeneuve 2014)

Confidence Score

90%

Known Aliases

PittyTiger

First Seen

Unknown

Last Updated

Unknown

Active Status

Active

Created

April 29, 2026

MITRE ATT&CK Techniques (2)

T1078 - Valid Accounts

Defense Evasion

T1588.002 - Tool

Resource Development

Indicators of Compromise

Loading IOCs…

IOC KQL for Sentinel

STIX Data

{'aliases': ['PittyTiger'],
 'created': '2017-05-31T21:31:50.198Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[PittyTiger](https://attack.mitre.org/groups/G0011) is a '
                'threat group believed to operate out of China that uses '
                'multiple different types of malware to maintain command and '
                'control.(Citation: Bizeul 2014)(Citation: Villeneuve 2014)',
 'external_references': [{'external_id': 'G0011',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0011'},
                         {'description': '(Citation: Bizeul 2014) (Citation: '
                                         'Villeneuve 2014)',
                          'source_name': 'PittyTiger'},
                         {'description': 'Bizeul, D., Fontarensky, I., '
                                         'Mouchoux, R., Perigaud, F., Pernet, '
                                         'C. (2014, July 11). Eye of the '
                                         'Tiger. Retrieved September 29, 2015.',
                          'source_name': 'Bizeul 2014',
                          'url': 'https://airbus-cyber-security.com/the-eye-of-the-tiger/'},
                         {'description': 'Villeneuve, N., Homan, J. (2014, '
                                         'July 31). Spy of the Tiger. '
                                         'Retrieved September 29, 2015.',
                          'source_name': 'Villeneuve 2014',
                          'url': 'https://www.fireeye.com/blog/threat-research/2014/07/spy-of-the-tiger.html'}],
 'id': 'intrusion-set--fe98767f-9df8-42b9-83c9-004b1dec8647',
 'modified': '2025-04-25T14:49:38.981Z',
 'name': 'PittyTiger',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '1.2'}