GENESIS PANDA's Cloud Intrusions: Persistent Control Plane Exploitation and Access Brokerage

GENESIS PANDA begins attacks by exploiting exposed services (e.g., Jenkins) and querying Instance Metadata Services (IMDS) on compromised cloud-hosted VMs to harvest credentials. With this access, the actor pivots into the cloud control plane, enabling actions like SSH access to other instances, cloud storage enumeration, and identity-based persistence. The actor regularly deploys malware and creates local users and SSH keys across compute instances. They also use cloud-native command-line tools, custom .NET-based malware, and impersonated cloud service domains for command-and-control (C2) and data exfiltration. Despite operating within compromised environments, GENESIS PANDA tends not to exfiltrate large datasets, reinforcing the assessment that their objective is access brokerage rather than intelligence collection.