Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
Also known as: Shell Crew, WebMasters, KungFu Kittens, PinkPanther, Black Vine
10
techniques
7
software
8,653
corpus matches
profile
Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. The intrusion into healthcare company Anthem has been attributed to Deep Panda. This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same.
techniques
10 attributed · most-instrumented first
software
7 malware & tools attributed
Derusbi
S0021
Net
S0039
Tasklist
S0057
Sakula
S0074
Mivast
S0080
Ping
S0097
StreamEx
S0142
read this carefully
8,653 corpus matches is not attribution
That count is indicators which exhibit techniques Deep Panda is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
showing 30 of 8,653
known aliases
Vendors name the same group differently. Searching any alias reaches this profile.