Deep Panda
Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. The intrusion into healthcare company Anthem has been attributed to Deep Panda. This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--a653431d-6a5e-4600-8ad3-609b5af57064
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-01T16:36:58+00:00
- Origin source
- attack_description
- Type
- intrusion-set
- Origin country
- CN
MITRE ATT&CK Techniques (10)
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains a
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be display
Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify t
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common
Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Later
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SM
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openl
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the
Software & Tools (7)
Derusbi is malware used by multiple Chinese APT groups.(Citation: ThreatConnect An
Mivast is a backdoor that has been used by Deep Panda. It was repo
The Net utility is a component of the Windows operating system. It is used in command-line operations for c
Ping is an operating system utility commonly used to troubleshoot and verify network connections. (Citation
Sakula is a remote access tool (RAT) that first surfaced in 2012 and was used in intrusions throughout 2015
StreamEx is a malware family that has been used by Deep Panda sinc
The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all task
Explore this actor's full graph with Ninja Signal