Deep Panda - G0009

Created: 2017-05-31T21:31:49.412Z

Modified: 2022-07-20T20:10:29.593Z

Contributors: Andrew Smith, @jakx_

Aliases

Deep Panda,Shell Crew,WebMasters,KungFu Kittens,PinkPanther,Black Vine

Description

Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. (Citation: Alperovitch 2014) The intrusion into healthcare company Anthem has been attributed to Deep Panda. (Citation: ThreatConnect Anthem) This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. (Citation: RSA Shell Crew) Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. (Citation: Symantec Black Vine) Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016)

Techniques Used

Deep Panda has used

PowerShell windows by setting the WindowStyle parameter to hidden. (Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Deep Panda has used ping to identify other machines of interest.(Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.(Citation: RSA Shell Crew)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.(Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Deep Panda uses net.exe to connect to network shares using