Liminal Panda is CrowdStrike’s name for a suspected China-nexus actor focused on telecommunications providers, unveiled in November 2024 in testimony to the U.S. Senate Judiciary Subcommittee. CrowdStrike assesses the China-nexus attribution at low confidence, resting on circumstantial evidence; definitive attribution to a specific Chinese state entity is inconclusive. The cluster overlaps earlier LightBasin/UNC1945 telecom activity but is tracked as distinct. Its tooling is purpose-built for carrier signaling networks and subscriber-metadata collection rather than financial gain.
Attribution
CrowdStrike attributes Liminal Panda to a China-nexus actor at low confidence, citing circumstantial indicators such as a reused Pinyin string and a Cobalt Strike delivery domain. Treat the China attribution as tentative. CrowdStrike reassigned some 2020–2021 LightBasin telecom activity to Liminal Panda but tracks the two as separate clusters.
Targeting
Telecommunications providers, for subscriber metadata and signals-intelligence collection rather than financial theft. Observed primarily in South Asia, Southeast Asia and Africa, with some reporting linking victims to Belt and Road Initiative geographies. Reporting on how long the group has been active varies between “since at least 2019” and “since at least 2020”.
Notable Activity
- November 2024: public disclosure by CrowdStrike, including Senate testimony, placing Liminal Panda within the broader wave of China-nexus telecom targeting alongside the separately tracked Salt Typhoon.
- January 2026: CrowdStrike attributed a new tool, SIGweaver — reported as a Linux kernel-level driver that inserts messages into 2G/3G/4G-LTE telecom traffic flows — to Liminal Panda at moderate confidence.
Malware & Tooling
CordScan (a network scanner supporting TCP and ICMP plus the telecom protocols GTP and SCTP), PingPong, SIGTRANslator, GSM-protocol-emulating C2, Cobalt Strike for delivery, and the reported SIGweaver traffic-injection driver. The telecom-protocol fluency is the defining feature.
MITRE ATT&CK Mapping
No official ATT&CK group ID — this is a CrowdStrike cluster; techniques below are mapped from reported behaviour.
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1133 External Remote Services | SSH to external DNS servers |
| Credential Access | T1110 Brute Force | Password dictionaries against root |
| Command and Control | T1572 Protocol Tunneling | GSM/telecom-protocol C2 |
| Lateral Movement | T1199 Trusted Relationship | Inter-carrier trust |
Detection & Mitigation
- Enforce SSH key authentication or strong non-default passwords on externally facing servers, especially external DNS (eDNS); restrict what eDNS servers can reach internally.
- Log and anomaly-monitor inter-server SSH; audit host firewall rules for unexpected inbound entries and run file-integrity checks on critical binaries.
- Deploy EDR broadly, including on non-internet-facing servers, and baseline signaling-plane traffic (GTP/SCTP) for anomalies.
Protect Telecom Signaling Networks
Mjolnir Security helps carriers detect intrusions that abuse signaling protocols and inter-network trust.
- Managed Detection and Response Monitoring signaling-plane traffic and inter-server SSH anomalies.
- Threat Hunting as a Service Hunting for CordScan-style scanning and telecom-protocol C2.
- 24/7 Incident Response Containment when carrier-network intrusion is suspected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts