MURKY PANDA: The China-Nexus Actor Targeting Europe's Financial Sector

Russian-aligned cyber activity has dominated European threat reporting for years — for clear reasons, including the war in Ukraine, the geopolitical alignment of European countries with Western support efforts, and the specific operational visibility of groups like APT28 and APT29. The result is a thoroughly mapped Russian threat picture and, by comparison, a less-developed public picture of the China-attributed threat to European industry.

MURKY PANDA is one of the names that closes that gap. Tracked by CrowdStrike, the actor operated a network of more than 150 compromised endpoints across 36 countries — with financial services among the most-targeted sectors — and represents what CrowdStrike's 2026 Financial Services Threat Landscape Report described as the most significant intelligence-collection threat to European finance.

This profile covers what is publicly known about MURKY PANDA, the operational relay box (ORB) infrastructure pattern it exemplifies, and what DORA-regulated entities should take from the China-attributed cyber threat landscape. For the broader regulatory context, see the complete NIS2 and DORA guide.

What is known about MURKY PANDA

MURKY PANDA is CrowdStrike's designation for a China-nexus threat actor. Public reporting on the actor — primarily through CrowdStrike's 2026 Financial Services Threat Landscape Report (14 May 2026) — has documented activity at the following scale:

• A network of more than 150 compromised endpoints across 36 countries
• Targeting of 340 organisations across more than 30 sectors
• Financial services among the most-frequently-targeted sectors
• An operational relay box (ORB) network used to relay command-and-control traffic and obscure attribution

The attribution is at the China-nexus level — that is, CrowdStrike's assessment based on technical indicators, infrastructure overlap, and tradecraft patterns is that the actor operates on behalf of, or in alignment with, Chinese state interests. Public reporting has not, at the time of this profile, specified a particular People's Liberation Army unit or Ministry of State Security bureau, the way US indictments have done for some other China-attributed groups (notably APT10 and APT41).

This is a different attribution quality from the cleaner Russian-actor attributions. APT28 has been formally attributed by name to GRU Unit 26165 by multiple governments. APT29 has been attributed by name to the SVR. MURKY PANDA carries the China-nexus assessment of a major intelligence vendor — which is a real and consequential signal — but without (yet) the multi-government corroboration that produces the strongest attribution category.

The honest framing, which we maintain throughout: this is CrowdStrike's assessment, reported here as the assessment of a named intelligence vendor with stated bases, not as Risk Letters' independent attribution.

The operational relay box pattern

Beyond MURKY PANDA specifically, the actor exemplifies a tradecraft pattern that has come to characterise China-nexus operations across the past several years: the operational relay box (ORB) network.

An ORB network is a constellation of compromised devices — typically routers, small office/home office equipment, VPS instances, and similar internet-edge infrastructure — that an actor uses to relay command-and-control traffic, source attacks, and host infrastructure. The ORB approach has three operational advantages that explain its popularity.

Attribution friction. Traffic from a compromised SOHO router in one country, attacking a target in another, makes attribution harder than direct connections from actor-controlled infrastructure. Each additional hop adds analytical work for defenders trying to characterise the source.

Resilience. ORB nodes are easy to add and easy to lose. When one is taken down — by the owner, by the device's vendor, by law enforcement — the actor can rotate to another. The infrastructure is fungible.

Distributed observation. With nodes in many countries, the actor has visibility into traffic patterns and target environments that a centralised infrastructure does not provide.

Mandiant and others have documented the ORB pattern as characteristic of multiple China-nexus actors, with the broader umbrella sometimes referred to as ORB networks of various designations (ORB3, others). MURKY PANDA's specific 150-endpoint, 36-country network is one observable instance of this broader infrastructure pattern.

What MURKY PANDA's targeting tells us

CrowdStrike's reporting documented MURKY PANDA hitting 340 organisations across more than 30 sectors — with financial services among the most-affected. This is consistent with the broader pattern of China-nexus intelligence collection: not a focus on the financial sector specifically, but the financial sector appearing prominently in a broader collection programme that also touches government, technology, manufacturing, and academic targets.

The collection priorities visible in public reporting on China-attributed activity in 2025-2026 align with stated Chinese strategic interests:

• Technology and intellectual property — semiconductor, AI, biotechnology, and advanced manufacturing organisations
• Financial sector intelligence — particularly around capital flows, market infrastructure, and sanctions evasion
• Government and policy intelligence — foreign ministries, defence ministries, think tanks
• Telecoms — for both signals intelligence access and disruption-capability prepositioning

For European DORA-regulated entities, the financial sector dimension is the relevant one. The specific operational pattern — patient collection through ORB infrastructure, compromise of third-party providers as routes to financial entities, identity-system targeting rather than perimeter exploitation — is consistent across multiple China-attributed actors and represents a recurring threat profile for the EU financial sector.

Recurring tradecraft

Across MURKY PANDA's publicly documented activity, and across the broader China-nexus pattern it exemplifies, several technical patterns recur.

• Operational relay box infrastructure. Compromised routers, edge devices, and VPS instances used to relay traffic and obscure source.
• Edge-device exploitation. Routers, firewalls, VPN appliances, and other internet-edge devices remain a consistent initial-access target for China-nexus actors — both as victim infrastructure and as nodes in ORB networks.
• Living-off-the-land tradecraft. Once inside a target environment, China-nexus operations have historically favoured legitimate administrative tools (PowerShell, WMI, PsExec) over distinctive malware, reducing detection signal.
• Long-dwell collection. Like APT29, China-nexus actors are typically patient — months or years of access to high-value targets, with selective extraction rather than rapid exfiltration.
• Supply-chain and managed-service-provider targeting. The 2018 APT10 / "Operation Cloud Hopper" pattern — targeting managed service providers as a route to their customers — has continued and broadened. Compromising one provider yields access to many downstream targets.

Why MURKY PANDA matters for DORA-regulated entities

Three implications specifically for European financial entities.

The financial sector is a documented China-nexus collection priority. CrowdStrike's positioning of MURKY PANDA — "the most significant intelligence-collection threat to European finance" in its 2026 report — is a strong statement from a named intelligence vendor with a substantial financial-sector visibility. It is appropriate to treat this as a real and current threat profile rather than a speculative one.

ORB infrastructure attacks the geopolitical dimension of supplier risk. A DORA-regulated entity using a cloud provider, a SaaS tool, or an ICT third-party operating from infrastructure that touches a jurisdiction with active state-aligned cyber operations is, definitionally, exposed to that operations' interest. The DORA Pillar 4 third-party regime — see DORA Third-Party Oversight — is the regulation's response to exactly this exposure, and the Register of Information is the artefact that lets a financial entity see where its provider geography concentrates risk.

Edge-device and identity-system controls are the operative defensive surface. Like APT29, MURKY PANDA-class operations target identity systems and edge infrastructure rather than user endpoints with deployed malware. The Article 21(2)(j) MFA and secured-comms measures of NIS2, and the equivalent identity-management obligations of DORA Pillar 1 — see DORA ICT Risk Management Framework Explained — are the regulatory expression of the controls that matter most.

How you would actually watch this

Three concrete monitoring postures.

Edge-device inventory, patching, and end-of-life management. Routers, VPN appliances, firewalls, and similar internet-edge equipment from major vendors have been a consistent China-nexus initial-access surface across the past several years. An accurate inventory, a current patch state, and a deliberate end-of-life replacement policy for unsupported devices shut down a large fraction of attempts. This is unglamorous, expensive, and the single highest-impact defensive investment against the actor profile.

Third-party provider jurisdiction mapping. The DORA Register of Information requires documenting where each ICT provider operates. Extending that document with a geopolitical-risk overlay — flagging providers whose subprocessors or support operations touch high-risk jurisdictions — turns the Register from compliance paperwork into intelligence. We developed this point at length in The Trust Supply Chain: How One ICT Provider Becomes Four Risks at Once.

Long-dwell anomaly detection. China-nexus actors are patient; their detection signal is statistical rather than acute. Identity-system baseline anomaly detection — unusual access patterns, off-hours administrative activity, atypical data movement over long windows — is the type of capability that matures slowly and pays back specifically against this actor profile.

How MURKY PANDA fits the wider China-nexus picture

MURKY PANDA is one named tracking cluster within a broader ecosystem of China-attributed cyber activity. For European entities thinking through their exposure, the wider context matters.

The publicly-documented Chinese threat actor inventory is large. APT10 (Stone Panda / MenuPass), APT41 (a partially financially-motivated cluster), APT40 (Leviathan), MUSTANG PANDA, VOLT TYPHOON (focused on US critical infrastructure with prepositioning concerns), VANGUARD PANDA, SILK TYPHOON — these and others are documented in industry tracking, with varying attribution quality from US government indictments at the strongest end to industry-only assessments at the weaker end.

Targeting patterns reflect Chinese strategic priorities. Technology, semiconductors, advanced manufacturing, telecoms, financial infrastructure, and policy intelligence are the recurring themes. European entities in these sectors are within the documented collection profile.

Operational tradecraft converges. ORB networks, edge-device exploitation, identity-system focus, supply-chain compromise, and long-dwell collection are common across multiple China-attributed actors. The defensive controls that work against one work against many.

The honest framing

Three notes on context.

The attribution category is "named-vendor China-nexus." This is a real and consequential category but distinct from the multi-government-corroborated attributions for some Russian actors. The actor's existence, scale, and targeting are well-documented by CrowdStrike's analysis. The state alignment is the analytical layer that has the more vendor-specific provenance.

Public reporting on MURKY PANDA is more limited than on the major Russian actors. This profile reflects what is publicly available; further detail may emerge as more vendors and government CERTs publish their tracking. The structural conclusions — ORB infrastructure, financial-sector targeting, edge-device exploitation, long-dwell tradecraft — are robust across the broader China-nexus pattern even where MURKY PANDA-specific detail is limited.

The risk does not require certain attribution to act on. A financial entity does not need to settle whether a particular incident is MURKY PANDA, another China-nexus cluster, or a sophisticated criminal actor before applying the defensive controls. The controls that matter — edge-device hardening, identity-system monitoring, third-party jurisdiction awareness — work against all of them.

The takeaway

Three things follow.

1. The China-nexus threat to European financial services is real and documented. CrowdStrike's 2026 reporting positions it as the most significant intelligence-collection threat to the sector. DORA-regulated entities should treat the China-attributed threat profile with the seriousness the data warrants.
2. ORB infrastructure is the new attribution-resistant operational pattern. The defensive response is not to chase attribution but to invest in the controls that work regardless — edge-device hygiene, identity-system telemetry, third-party jurisdiction awareness.
3. The DORA regulatory toolkit fits the actor profile. Pillar 4 third-party oversight, the Register of Information, Pillar 1 identification of dependencies — these are the regulatory instruments that turn an abstract China-nexus threat into a manageable mapping of the entity's actual exposure.

For the cross-domain analysis this profile connects to, The Trust Supply Chain. For the DORA Pillar 4 mechanics, DORA Third-Party Oversight and DORA Register of Information.

---

Sources & further reading

• CrowdStrike — 2026 Financial Services Threat Landscape Report (14 May 2026)
• CrowdStrike — Annual Global Threat Report (China-nexus actor tracking)
• Mandiant — China-nexus threat actor tracking and ORB network analysis
• US Department of Justice — China-attributed indictments and advisories (APT10, APT41, and others, as context)
• US Cybersecurity and Infrastructure Security Agency (CISA) — China-nexus advisories
• UK National Cyber Security Centre — China-attributed threat reporting
• Recorded Future Insikt Group — China-nexus operational tracking

Attribution note: MURKY PANDA's "China-nexus" designation reflects CrowdStrike's stated assessment based on the technical and operational indicators its analysts have documented. This profile reports CrowdStrike's assessment as the assessment of a named intelligence vendor. The broader pattern of China-attributed cyber activity referenced in the article reflects the collective publicly-available reporting of multiple Western governments and intelligence-industry firms.