Deep Panda

Threat Actors · Deep Panda

· ATT&CK GroupG0009

Shell CrewWebMastersKungFu KittensPinkPantherBlack Vine

Techniques

Software

Tactics

Aliases

Description

Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. (Citation: Alperovitch 2014) The intrusion into healthcare company Anthem has been attributed to Deep Panda. (Citation: ThreatConnect Anthem) This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. (Citation: RSA Shell Crew) Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. (Citation: Symantec Black Vine) Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016)

Tactic Coverage

stealth (3)discovery (2)execution (2)persistence (2)lateral movement (1)privilege escalation (1)

Techniques Used (10)

T1018Remote System Discovery

discovery

T1021.002SMB/Windows Admin Shares

lateral movement

T1027.005Indicator Removal from Tools

stealth

T1047Windows Management Instrumentation

execution

T1057Process Discovery

discovery

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 10 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (7)

S0021Derusbimalware S0080Mivastmalware S0039Nettool S0097Pingtool S0074Sakulamalware S0142StreamExmalware S0057Tasklisttool

References (12)

https://attack.mitre.org/groups/G0009 https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/https://web.archive.org/web/20170823094836/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf https://www.rsa.com/content/dam/en/white-paper/rsa-incident-response-emerging-threat-profile-shell-crew.pdf https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/