Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT19 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT19

  • DEEP PANDA
  • Codoso
  • WebMasters
  • KungFu Kittens
  • Black Vine
  • TEMP.Avengers
  • Group 13
  • PinkPanther

state sponsor · ChinaMITRE G0073 ↗

APT19 — ATT&CK roseAP

attack rose · 21 techniques across 8 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2012-4792

Analyst brief

misp-galaxy + mitre-attack

Adversary group targeting financial, technology, non-profit organisations.

Observed targets (as stated by the sources)

1 countries · 5 sectors
United StatesAssessed origin: China

assessed origin · Chinaobserved targets · 1

countries · 1

  • United States

sectors · 5

  • Private sector
  • Military
  • Technology
  • Finance
  • Non-profit organisation

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

21 techniques · 8 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    2 techniques

  3. Execution

    3 techniques

  4. Persistence

    2 techniques

  5. Stealth

    7 techniques

  6. Defense impairment

    1 technique

  7. Discovery

    3 techniques

  8. Command and control

    2 techniques

select a technique

Arsenal

1 malware · 1 tools
Malware
Malware · 1ATT&CK
Cobalt StrikeS0154 ↗
Tools
Tools · 1ATT&CK
EmpireS0363 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs APT19 is cited as exploiting

none on KEV
  1. CVE-2012-47922026-10-17
    1. “serving an exploit for a zero-day bug known as the Microsoft Internet Explorer ‘CDwnBindInfo’ Use-After-Free Remote Code Execution Vulnerability (CVE-2012-4792). Users who browsed Capstone’s website using vulnerable versions of Internet Explorer at the time were ultimately compromised with the Sakurel payload. Sakurel provided Black Vine with access”

      cited as exploiting · source: docs.broadcom.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili RootkitsFortinet ↗
  2. 2015The Black Vine Cyberespionage GroupSymantec ↗
  3. 2014Mo' Shells Mo' Problems - Deep Panda Web ShellsCrowdstrike ↗
  4. 2014I Am Ironman: Deep Panda Uses Sakula Malware To Target Organizations In Multiple SectorsCrowdstrike ↗
  5. 2013Deep PandaCrowdstrike ↗

Take it with you

keyless · no signup

References

40 sources
  1. 1.cybercampaigns.net/wp-content/uploads/2013/06/Deep-Panda.pdf
  2. 2.docs.huihoo.com/rsaconference/usa-2014/anf-t07b-the-art-of-attribution…
  3. 3.cfr.org/interactive/cyber-operations/deep-panda
  4. 4.eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-agains…
  5. 5.eromang.zataz.com/2013/01/02/capstone-turbine-corporation-also-targeted-…
  6. 6.crowdstrike.com/blog/department-labor-strategic-web-compromise
  7. 7.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-…
  8. 8.krebsonsecurity.com/2015/06/catching-up-on-the-opm-breach
  9. 9.krebsonsecurity.com/2015/02/anthem-breach-may-have-started-in-april-2014
  10. 10.nextgov.com/cybersecurity/2015/05/third-party-software-was-entry-p…
  11. +30 more in the JSON record

Track APT19 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.