Deep Panda

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: Shell Crew, WebMasters, KungFu Kittens, PinkPanther, Black Vine

CyberCHN

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeSuspected state-linked cyber threat group

Alternative designationsShell Crew, WebMasters, KungFu Kittens, PinkPanther, Black Vine

ProliferationOrigin country only

MITRE ATT&CK IDG0009High^[1]

Capabilities

ATT&CK techniques used10ATT&CK v20.1High^[1]

Malware and toolsDerusbi, Mivast, Net, Ping, Sakula, StreamEx, Tasklist7 malware and tool entries linked in ATT&CKHigh^[1]

Attribution and activity

Attributed sponsorSuspected Chinese groupMed^[1]

TargetsDeep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications.Med^[1]

Notes

Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. The intrusion into healthcare company Anthem has been attributed to Deep Panda. This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

China

Sources

Deep Panda, Group G0009, MITRE ATT&CK
Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0009)