APT19
Also known as DEEP PANDA, Codoso, WebMasters, KungFu Kittens, Black Vine, TEMP.Avengers, Group 13, PinkPanther, Shell Crew, BRONZE FIRESTONE, G0009, G0073, Pupa, Sunshop Group, Checkered Typhoon, C0d0so0, Codoso Team
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Adversary group targeting financial, technology, non-profit organisations.
Targets: Private sector, Military, United States
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1016 System Network Configuration DiscoveryT1027.010 Command ObfuscationT1027.013 Encrypted/Encoded FileT1033 System Owner/User DiscoveryT1059 Command and Scripting InterpreterT1059.001 PowerShellT1071.001 Web ProtocolsT1082 System Information DiscoveryT1112 Modify RegistryT1132.001 Standard EncodingT1140 Deobfuscate/Decode Files or InformationT1189 Drive-by CompromiseT1204.002 Malicious FileT1218.010 Regsvr32T1218.011 Rundll32T1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1564.003 Hidden WindowT1566.001 Spearphishing AttachmentT1574.001 DLLT1588.002 Tool
Recent activity
No posts or advisories have named this actor recently.
References
- http://cybercampaigns.net/wp-content/uploads/2013/06/Deep-Panda.pdf
- https://docs.huihoo.com/rsaconference/usa-2014/anf-t07b-the-art-of-attribution-identifying-and-pursuing-your-cyber-adversaries-final.pdf
- https://www.cfr.org/interactive/cyber-operations/deep-panda
- https://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/
- https://eromang.zataz.com/2013/01/02/capstone-turbine-corporation-also-targeted-in-the-cfr-watering-hole-attack-and-more/
- https://www.crowdstrike.com/blog/department-labor-strategic-web-compromise/
- https://www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/
- https://krebsonsecurity.com/2015/06/catching-up-on-the-opm-breach/
- https://krebsonsecurity.com/2015/02/anthem-breach-may-have-started-in-april-2014/
- https://www.nextgov.com/cybersecurity/2015/05/third-party-software-was-entry-point-background-check-system-hack/112354/
- https://www.crowdstrike.com/blog/ironman-deep-panda-uses-sakula-malware-target-organizations-multiple-sectors/
- https://www.abc.net.au/news/2014-11-13/g20-china-affliliated-hackers-breaches-australian-media/5889442
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.