Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Groups
  3. Deep Panda

Deep Panda

Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications.[1] The intrusion into healthcare company Anthem has been attributed toDeep Panda.[2] This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther.[3]Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion.[4] Some analysts trackDeep Panda andAPT19 as the same group, but it is unclear from open source information if the groups are the same.[5]

ID: G0009
ⓘ
Associated Groups: Shell Crew, WebMasters, KungFu Kittens, PinkPanther, Black Vine
Contributors: Andrew Smith, @jakx_
Version: 1.2
Created: 31 May 2017
Last Modified: 16 April 2025

Associated Group Descriptions

NameDescription
Shell Crew

[3]

WebMasters

[3]

KungFu Kittens

[3]

PinkPanther

[3]

Black Vine

[4]

Enterprise Layer
downloadview

Techniques Used

DomainIDNameUse
EnterpriseT1059.001Command and Scripting Interpreter:PowerShell

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.[1]

EnterpriseT1546.008Event Triggered Execution:Accessibility Features

Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.[3]

EnterpriseT1564.003Hide Artifacts:Hidden Window

Deep Panda has used-w hidden to concealPowerShell windows by setting the WindowStyle parameter to hidden.[1]

EnterpriseT1027.005Obfuscated Files or Information:Indicator Removal from Tools

Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.[4]

EnterpriseT1057Process Discovery

Deep Panda uses the MicrosoftTasklist utility to list processes running on systems.[1]

EnterpriseT1021.002Remote Services:SMB/Windows Admin Shares

Deep Panda uses net.exe to connect to network shares usingnet use commands with compromised credentials.[1]

EnterpriseT1018Remote System Discovery

Deep Panda has used ping to identify other machines of interest.[1]

EnterpriseT1505.003Server Software Component:Web Shell

Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.[6]

EnterpriseT1218.010System Binary Proxy Execution:Regsvr32

Deep Panda has used regsvr32.exe to execute a server variant ofDerusbi in victim networks.[3]

EnterpriseT1047Windows Management Instrumentation

TheDeep Panda group is known to utilize WMI for lateral movement.[1]

Software

IDNameReferencesTechniques
S0021Derusbi[2]Audio Capture,Command and Scripting Interpreter:Unix Shell,Encrypted Channel:Symmetric Cryptography,Fallback Channels,File and Directory Discovery,Indicator Removal:Timestomp,Indicator Removal:File Deletion,Input Capture:Keylogging,Non-Application Layer Protocol,Non-Standard Port,Process Discovery,Process Injection:Dynamic-link Library Injection,Query Registry,Screen Capture,System Binary Proxy Execution:Regsvr32,System Information Discovery,System Owner/User Discovery,Video Capture
S0080Mivast[4]Boot or Logon Autostart Execution:Registry Run Keys / Startup Folder,Command and Scripting Interpreter:Windows Command Shell,Ingress Tool Transfer,OS Credential Dumping:Security Account Manager
S0039Net[1]Account Discovery:Domain Account,Account Discovery:Local Account,Account Manipulation:Additional Local or Domain Groups,Create Account:Local Account,Create Account:Domain Account,Indicator Removal:Network Share Connection Removal,Network Share Discovery,Password Policy Discovery,Permission Groups Discovery:Domain Groups,Permission Groups Discovery:Local Groups,Remote Services:SMB/Windows Admin Shares,Remote System Discovery,System Network Connections Discovery,System Service Discovery,System Services:Service Execution,System Time Discovery
S0097Ping[1]Remote System Discovery
S0074Sakula[2]Abuse Elevation Control Mechanism:Bypass User Account Control,Application Layer Protocol:Web Protocols,Boot or Logon Autostart Execution:Registry Run Keys / Startup Folder,Command and Scripting Interpreter:Windows Command Shell,Create or Modify System Process:Windows Service,Encrypted Channel:Symmetric Cryptography,Hijack Execution Flow:DLL,Indicator Removal:File Deletion,Ingress Tool Transfer,Obfuscated Files or Information:Encrypted/Encoded File,System Binary Proxy Execution:Rundll32
S0142StreamEx[7]Command and Scripting Interpreter:Windows Command Shell,Create or Modify System Process:Windows Service,File and Directory Discovery,Modify Registry,Obfuscated Files or Information,Process Discovery,Software Discovery:Security Software Discovery,System Binary Proxy Execution:Rundll32,System Information Discovery
S0057Tasklist[1]Process Discovery,Software Discovery:Security Software Discovery,System Service Discovery

References

×
[8]ページ先頭
©2009-2026 Movatter.jp