AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Deep Panda
Aliases: Black Vine, Deep Panda, KungFu Kittens, PinkPanther, Shell Crew, WebMasters
[Deep Panda](https://attack.mitre.org/groups/G0009) is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. (Citation: Alperovitch 2014) The intrusion into healthcare company Anthem has been attributed to [Deep Panda](https://attack.mitre.org/groups/G0009). (Citation: ThreatConnect Anthem) This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. (Citation: RSA Shell Crew) [Deep Panda](https://attack.mitre.org/groups/G0009) also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. (Citation: Symantec Black Vine) Some analysts track [Deep Panda](https://attack.mitre.org/groups/G0009) and [APT19](https://attack.mitre.org/groups/G0073) as the same group, but it is unclear from open source information if the groups are the same. (Citation: ICIT China's Espionage Jul 2016)
Open interactive actor investigation
ATT&CK techniques
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tasklist tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Ping tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.005 Indicator Removal from Tools simulation — Exact active technique ID
- T1027.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.010 Regsvr32 simulation — Exact active technique ID
- T1218.010 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.008 Accessibility Features simulation — Exact active technique ID
- T1546.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.003 Hidden Window simulation — Exact active technique ID
- T1564.003 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Blue Team & Defensive Security · explicit-idModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameDisassembly, decompilation, and code-led analysis
Malware Analysis & Reverse Engineering · topic-matchGovernance, risk, assurance, transparency, and human factors
AI Security · topic-matchModule 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · topic-matchEndpoint live response and volatile acquisition
Digital Forensics & Incident Response (DFIR) · topic-matchArchitecture, calling conventions, and assembly literacy
Malware Analysis & Reverse Engineering · topic-matchFamily classification, behavior models, YARA, and ATT CK
Malware Analysis & Reverse Engineering · topic-matchIntake, provenance, and analysis scope
Malware Analysis & Reverse Engineering · topic-matchPacking, obfuscation, and anti-analysis
Malware Analysis & Reverse Engineering · topic-matchInternet exposure, service indexes, and infrastructure search
OSINT & Reconnaissance · tactic-route