Turbine Panda, APT 26, Shell Crew, WebMasters, KungFu Kittens
Description
(RSA) During recent engagements, the RSA IR Team has responded to multiple incidents involving a common adversary targeting each client’s infrastructure and assets. The RSA IR Team is referring to this threat group internally as “Shell_Crew”; however, they are also referred to as Deep Panda, WebMasters, KungFu Kittens, SportsFans, and PinkPanther amongst the security community.
Some analysts track Turbine Panda, DarkHydrus, LazyMeerkat and APT 19, Deep Panda, C0d0so0 as the same group, but it is unclear from open source information if the groups are the same. Turbine Panda has some overlap with Emissary Panda, APT 27, LuckyMouse, Bronze Union.
Names
| Name | Name-Giver |
|---|---|
| Turbine Panda | CrowdStrike |
| APT 26 | Mandiant |
| Shell Crew | RSA |
| WebMasters | Kaspersky |
| KungFu Kittens | FireEye |
| Group 13 | Talos |
| PinkPanther | RSA |
| Black Vine | Symantec |
| Bronze Express | SecureWorks |
| JerseyMikes | ? |
| Taffeta Typhoon | Microsoft |
Country
Sponsor
State-sponsored, the Jiangsu Bureau of the MSS (JSSD/江苏省国家安全厅)
Motivation
- Information theft and espionage
- Financial crime
First Seen
2010
Observed Sectors
- Aerospace
- Aviation
- Defense
- Energy
- Financial
- Food and Agriculture
- Government
- Healthcare
- Non-profit organizations
- Telecommunications
- Think Tanks
Observed Countries
Tools
- Cobalt Strike
- Derusbi
- FormerFirstRAT
- Hurix
- Mivast
- PlugX
- Sakula RAT
- StreamEx
- Winnti
- Living off the Land
Operations
- 2012-12: Attack and IE 0day Information Used Against Council on Foreign Relations Regarding information’s posted on the Washington Free Beacon, infected CFR.org website was used to attack visitors in order to extract valuable information’s. The “drive-by” attack was detected around 2:00 pm on Wednesday 26 December and CFR members who visited the website between Wednesday and Thursday could have been infected and their data compromised, the specialists said. https://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/
- 2012-12: Capstone Turbine Corporation Also Targeted in the CFR Watering Hole Attack https://eromang.zataz.com/2013/01/02/capstone-turbine-corporation-also-targeted-in-the-cfr-watering-hole-attack-and-more/
- 2015-05: StreamEx malware Cylance SPEAR has identified a newer family of samples deployed by Shell Crew that has flown under AV’s radar for more than a year and a half. Simple programmatic techniques continue to be effective in evading signature-based detection. https://threatvector.cylance.com/en_us/home/shell-crew-variants-continue-to-fly-under-big-avs-radar.html
Counter Operations
- 2018-10: Chinese Intelligence Officers and Their Recruited Hackers and Insiders Conspired to Steal Sensitive Commercial Aviation and Technological Data for Years https://www.justice.gov/opa/pr/chinese-intelligence-officers-and-their-recruited-hackers-and-insiders-conspired-steal https://www.justice.gov/opa/pr/chinese-intelligence-officer-charged-economic-espionage-involving-theft-trade-secrets-leading https://www.justice.gov/opa/pr/jury-convicts-chinese-intelligence-officer-espionage-crimes-attempting-steal-trade-secrets
Information
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/h12756-wp-shell-crew.pdf
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf
- https://www.crowdstrike.com/resources/wp-content/brochures/reports/huge-fan-of-your-work-intelligence-report.pdf
Other Information
Uuid
442f4919-150b-4e0f-9867-1ebd78f54a9c
Last Card Change
2025-06-28