Skip to content
skopnix
← Adversaries

File · Deep Panda · Unknown · refreshed 2026-10-18

Deep Panda

  • Shell Crew
  • WebMasters
  • KungFu Kittens
  • PinkPanther
  • Black Vine

MITRE G0009 ↗

Deep Panda — ATT&CK roseDP

attack rose · 10 techniques across 6 tactics

Analyst brief

Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. The intrusion into healthcare company Anthem has been attributed to Deep Panda. This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther.

Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same.

Observed targets (as stated by the sources)

1 countries · 0 sectors
China

assessed originnot stated by sourcesobserved targets · 1

countries · 1

  • China

as stated by the cited sources, not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

10 techniques · 6 of 15 tactics

  1. Execution

    2 techniques

  2. Persistence

    1 technique

  3. Privilege escalation

    1 technique

  4. Stealth

    3 techniques

  5. Discovery

    2 techniques

  6. Lateral movement

    1 technique

select a technique

Arsenal

4 malware · 3 tools
Malware
Malware · 4ATT&CK
MivastS0080 ↗
StreamExS0142 ↗
SakulaS0074 ↗
DerusbiS0021 ↗
Tools
Tools · 3ATT&CK
PingS0097 ↗
NetS0039 ↗
TasklistS0057 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Detections

3 rules · Sigma · QRadar · Cortex

  1. Behaviour (ATT&CK technique)

    PowerShell download cradle executed from the command line (T1059.001)

    APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 81 more

    T1059.001conf 80SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Primary-source reports

linked, never re-hosted
  1. 2022New Milestones for Deep Panda: Log4Shell and Digitally Signed Fire Chili RootkitsFortinet ↗
  2. 2015The Black Vine Cyberespionage GroupSymantec ↗
  3. 2014Mo' Shells Mo' Problems - Deep Panda Web ShellsCrowdstrike ↗
  4. 2014I Am Ironman: Deep Panda Uses Sakula Malware To Target Organizations In Multiple SectorsCrowdstrike ↗
  5. 2013Deep PandaCrowdstrike ↗

Take it with you

keyless · no signup

References

6 sources
  1. 1.attack.mitre.org/groups/G0009
  2. 2.web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/dee…
  3. 3.web.archive.org/web/20170823094836/http:/www.symantec.com/content/en/u…
  4. 4.rsa.com/content/dam/en/white-paper/rsa-incident-response-emerg…
  5. 5.web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chin…
  6. 6.threatconnect.com/the-anthem-hack-all-roads-lead-to-china

Track Deep Panda on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.