- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- A group likely composed of freelancers, with some degree of sponsorship by the Chinese government. (FireEye)
- Motivation
- Espionage; Financial crime; Financial gain; Information theft and espionage
- Seen
- 2010–2026
- Status
- Active
- ATT&CK
- G0009 · 10 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0026 · deep-panda
ChinaWhat it is
Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. The intrusion into healthcare company Anthem has been attributed to Deep Panda. This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Nightshade Panda, Turbine Panda
- Mandiant
- APT 19, APT19, APT26, APT9, APT 26, APT 9, TEMP.Avengers
- Microsoft
- Taffeta Typhoon, Checkered Typhoon
- MITRE ATT&CK
- G0009
- PwC
- Red Kobold, Red Pegasus
- Secureworks
- TG-0055, TG-3551
- Talos and others
- Group 13, Group 27
- Operations
- Operation “Kingslayer”, Operation “Seven Pointed Dagger”
- Other names
- APT 19, Deep Panda, C0d0so0, BEARCLAW, Black Vine, Bronze Express, Bronze Firestone, C0d0so0, Codoso, FlowerLady, FlowerShow, JerseyMikes, KungFu Kittens, Nightshade Panda, APT 9, Group 27, PinkPanther, Pupa, Shell Crew, Sunshop Group, TECHNETIUM, Turbine Panda, APT 26, Shell Crew, WebMasters, KungFu Kittens, WebMasters
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Australia, Canada, China, Denmark, France, Germany, India, Italy, Myanmar, Thailand, United Kingdom, United States
- Sectors
- Aerospace, Aviation, Construction, Defense, Defense industrial base, Education, Energy, Finance, Financial, Food and Agriculture, Government, Healthcare, High-Tech, Manufacturing, Media, Military, Non-profit organisation, Non-profit organizations, Pharmaceutical, Pharmaceuticals, Private sector, Technology, Telecommunications, Think Tanks, Utilities
Tools
The tools and malware families the sources tie to it.
- 3102 RAT
- 3102 variant of 9002 RAT
- 9002 RAT
- BIGJOLT
- Backdoor.Oldrea
- COATHOOK
- Cobalt
- Cyber Eye RAT
- CyberGate
- Derusbi
- EvilGrab
- EvilGrab RAT
- FUNRUN
- GH0ST
- GSECDUMP
- HOMEUNIX
- HTRAN
- JIM A
- Mivast
- MoonWind RAT
- Net
- PHOTO
- Ping
- PlugX
- Poison Ivy
- QUICKBALL
- QuickPulse
- Remote Utilities
- RemoteCMD
- RemotePC
- SKINNYGENE
- SOGU
- Sakula
- StreamEx
- TWOCHAINS
- Tasklist
- Trochilus RAT
- VICEROY
- VIPSH ELL
- WETHEAD
- XDOOR
- ZXSHELL
- credential stealers such as WCE
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de