Threat Actor

PittyTiger

Also known as: PittyTiger

[PittyTiger](https://attack.mitre.org/groups/G0011) is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.(Citation: Bizeul 2014)(Citation: Villeneuve 2014)

2
Techniques
6
Software

Properties

stix_id
intrusion-set--fe98767f-9df8-42b9-83c9-004b1dec8647
signal_observed_at
2026-09-11T17:55:00+00:00
type
intrusion-set

MITRE ATT&CK Techniques (2)

Tool

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

Software & Tools (6)

Lurid [malware]

[Lurid](https://attack.mitre.org/software/S0010) is a malware family that has been used by several groups, including [PittyTiger](https://attack.mitre

MimiKatz [malware]

[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

Mimikatz [tool]

[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

PoisonIvy [malware]

[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison

gh0st RAT [malware]

[gh0st RAT](https://attack.mitre.org/software/S0032) is a remote access tool (RAT). The source code is public and it has been used by multiple groups.

gsecdump [tool]

[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Wind

Explore this actor's full graph with Ninja Signal

PittyTiger — Threat Actor Profile — Ninja Signal | Ninja Signal