# ThreatThursday: Deep Panda

This week we interviewed Bradford Regeski, a Cyber Threat Intelligence analyst at [H-ISAC](https://h-isac.org/), about the top threats the healthcare industry is seeing. He shared a number of excellent resources on threat actors, told us a little more about H-ISAC, and dove deeper into [Deep Panda](https://attack.mitre.org/groups/G0009/). As usual, we took this Cyber Threat Intelligence about Deep Panda to create an adversary emulation plan, this time targeting Linux systems, showed you how to emulate the adversary, and discuss defending against threat actors targeting the healthcare industry. As a reminder, SCYTHE has an [open offer for healthcare organizations](/content/healthcare/index.html) to use our platform, for free, until the end of the year. It is our way of giving back to a community we have all relied on this year.

### Cyber Threat Intelligence

This week we learned about [H-ISAC](https://h-isac.org/) and received some great Cyber Threat Intelligence based on their primary focus: sharing timely, actionable, and relevant information with each other including intelligence on threats, incidents and vulnerabilities.

Brad referenced an [excellent resource that is TLP:White](https://www.aha.org/system/files/media/file/2020/06/hc3-cyber-alert-tlp-white-apt-cybercriminal-targeting-hcs-6-9-2020.pdf), meaning we can share it publicly, from the Health Sector CyberSecurity Coordination Center (HC3). Within this document we can obtain more information about [Deep Panda](https://attack.mitre.org/groups/G0009/) who, like [Orangeworm](/content/library/threatthursday-orangeworm/index.html), has a number of TTPs attributed to their behavior and also a number of malware:

- [Derusbi](https://attack.mitre.org/software/S0021/)
- [Mivast](https://attack.mitre.org/software/S0080/)
- [Sakula](https://attack.mitre.org/software/S0074/)
- [StreamEx](https://attack.mitre.org/software/S0142/)

This week, we will focus on emulating malware in Linux and have chosen [Derusbi](https://attack.mitre.org/software/S0021/) to be the example. Here is the Threat Profile for Deep Panda using Derusbi:

|     |     |
| --- | --- |
| **Tactic** | **Description** |
| Description | Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. The intrusion into healthcare company Anthem has been attributed to Deep Panda. Derusbi is malware used by multiple Chinese APT groups. Both Windows and Linux variants have been observed |
| Objective | Maintain and sell access to compromised environments |
| Command and Control | T1573 - Encrypted Channel<br>T1573.001 - Symmetric Cryptography<br>T1008 - Fallback Channels<br>T1095 - Non-Application Layer Protocol<br>T1571 - Non-Standard Port |
| Defense Evasion | T1070 - Indicator Removal on Host<br>T1070.006 - Timestomp<br>T1070.004 - File Deletion<br>T1055 - Process Injection<br>T1055 - Process Injection<br>T1055.001 - Dynamic-link Library Injection<br>T1055.001 - Dynamic-link Library Injection<br>T1218 - Signed Binary Proxy Execution<br>T1218.010 - Regsvr32 |
| Execution | T1059 - Command and Scripting Interpreter<br>T1059.004 - Unix Shell |
| Discovery | T1083 - File and Directory Discovery<br>T1057 - Process Discovery<br>T1012 - Query Registry<br>T1082 - System Information Discovery<br>T1033 - System Owner/User Discovery |
| Collection | T1123 - Audio Capture<br>T1056 - Input Capture<br>T1056 - Input Capture<br>T1056.001 - Keylogging<br>T1056.001 - Keylogging<br>T1113 - Screen Capture<br>T1125 - Video Capture |

Like last week’s [Orangeworm](/content/library/threatthursday-orangeworm/index.html) post, we are now providing the [ATT&CK Navigator Layers for Deep Panda](https://github.com/scythe-io/community-threats/blob/master/DeepPanda/deeppanda_layer.json) and [Derusbi](https://github.com/scythe-io/community-threats/blob/master/DeepPanda/Derusbi_layer.json) so you can quickly visualize the TTPs they leverage.

### Adversary Emulation Plan

This is the first #ThreatThursday where we emulate a Linux malware so let’s walk through these steps. Creating a Linux campaign is very similar to the Windows campaigns we have done:

- Select New Campaign under the Campaign Manager dropdown menu on the left.
- Give the campaign a name
- Select Linux as the Target operating system
- Add a start date and end date (optional)
- Select the communication module. In this case, we will do HTTPS
- Select the parameters or upload a profile
- Click Next

On the Automate Campaign screen we will import our existing threat that was created by our Sales Engineer, Sean Sun:

- Click Existing Threats under the Compound Actions menu
- Select an existing threat, in this case Desrubi
- Click Add Steps

Deep Panda, like Sandworm, lives off the land which means you will be able to execute most of these commands without the SCYTHE automation, manually from a console. However, SCYTHE does have the uploader and downloader module which allows you to move files to and from the Virtual File System. This is very convenient for an operator. All the steps can be extracted from the [JSON file](https://github.com/scythe-io/community-threats/blob/master/DeepPanda/Deep_Panda_Desrubi_scythe_threat.json) hosted on our community threats.

### Defend against Deep Panda

Like many other malware families, defense against Deep Panda should be first centered around detection of unexpected behaviors. As demonstrated above, Deep Panda uses its access to create files; this creates an initial important touchpoint in which a defender could be alerted if file creation is occurring in an unexpected manner on this Linux system. Monitoring for unexpected file system changes, or package installation, can be even more critical for systems with no standardized Antivirus or EDR deployments, which is often the case for Linux endpoints. Finally, it is worth reiterating that using a robust permissions model, including implementing and tuning tools such as SELinux, can be critical in protecting vital Linux-based infrastructure.

### Conclusion

This week we learned about H-ISAC and the work they are doing to collaborate with the Healthcare sector. We want to thank Brad for spending some time with us and talking about Deep Panda. We consumed Cyber Threat Intelligence from various sources and created a Linux variant of Desrubi. We learned how to create and run a Linux campaign as well as some manual commands that can be executed if you do not have SCYTHE yet. Lastly, we covered how to defend against Linux malware. We hope you enjoyed our #ThreatThursday and thanks again to Brad for coming on the show.