How can organisations defend against Deep Panda?

Why Deep Panda Defence Starts with Identity and Access Control

deep panda campaigns are usually harder to stop than they are to notice, because the group tends to turn stolen access into a long-dwell intrusion. That makes initial phishing resistance important, but it also means access paths, privileged accounts, and remote administration routes need to be treated as part of the attack surface, not just as operational conveniences.

Segmenting critical assets matters because lateral movement is often the step that turns one compromised user or host into broad enterprise reach. If the attacker can reuse credentials, move through administrative tooling, or reach high-value servers from a low-trust foothold, the defensive problem becomes containment as much as prevention. NIST Cybersecurity Framework 2.0 is useful here because it pushes organisations to connect identify, protect, detect, respond, and recover instead of treating them as separate exercises.

Detection also has to match the way persistent actors operate. In practice, that means monitoring for the behaviours that often accompany hands-on intrusion work, such as unusual authentication patterns, scheduled task creation, credential dumping attempts, and outbound connections that do not fit normal workstation or server behaviour. Correlating endpoint, identity, and network telemetry gives analysts a better chance of seeing the whole chain, not just isolated alerts.

Where Deep Panda Intrusions Usually Gain Leverage

The main defensive weakness is not a single exploit, but the combination of exposed services, weak credential hygiene, and insufficiently constrained privilege. Once an attacker has one reliable foothold, they often try to increase access quietly, then use legitimate tools and trusted channels to reduce noise. That is why patching exposed services and tightening privilege boundaries are both part of the same defensive problem.

Credential theft is especially dangerous in this pattern because it converts a one-time compromise into repeatable access. Monitoring for credential dumping, anomalous logons, and privilege escalation gives defenders a way to spot that transition early. MITRE ATT&CK Enterprise Matrix is a strong reference for mapping those behaviours to known tactics such as credential access, lateral movement, and persistence.

Network segmentation and restricted administrative pathways reduce the value of one compromised endpoint. If workstations can reach management interfaces, or if one admin credential can touch too many systems, the intrusion can spread faster than detection can keep up. Strong segmentation does not eliminate compromise, but it narrows the blast radius and gives defenders more time to respond.

Building Detection for Long-Dwell Intrusions

Long-dwell intrusions are often found through inconsistency, not through a single signature. The practical goal is to identify when persistence mechanisms, remote access, or data staging diverge from the normal baseline. That is why defenders should watch for scheduled tasks, unusual service creation, repeated authentication failures followed by success, and outbound traffic that suggests staging or exfiltration.

Phishing-resistant authentication is also relevant because it reduces the payoff from token theft, replay, and credential harvesting. NIST SP 800-63 Digital Identity Guidelines supports this emphasis by centring phishing-resistant authenticators and assurance-aware identity decisions. In a campaign like this, that matters because the attacker usually wants durable access, not just a single session.

For defenders, the most useful telemetry is the kind that links identity events to endpoint and network behaviour. A suspicious login matters more when it is followed by privilege use, remote execution, or unexpected file movement. Similarly, a host alert matters more when it lines up with new credentials, new tasks, or new outbound destinations. That joined-up view is what turns scattered signals into a credible intrusion picture.

Risk and Threat Considerations

Deep Panda-style activity is risky because the attacker can often remain operational inside an environment after the first compromise is no longer visible. The longer the dwell time, the more chance there is for credential reuse, privilege expansion, and data access that looks routine from the inside.

Failure mechanism: A single phishing success, exposed service, or weak admin boundary gives the attacker a foothold, then stolen credentials and trusted tools let them move laterally and establish persistence without triggering obvious alarms.

Impact: The result can be prolonged access to critical systems, broader credential compromise, and data exfiltration that is discovered only after the intrusion has already spread across multiple hosts or business functions.

Practitioner Guidance

What to prioritise: Focus first on the controls that reduce attacker reuse of access, namely phishing-resistant authentication, least privilege, and segmentation around the systems that matter most. If those controls are weak, detection will usually arrive after the attacker has already expanded access.

What to verify: Confirm that endpoint, identity, and network telemetry can be correlated quickly enough to show a complete intrusion path. A useful test is whether analysts can trace a suspicious login into subsequent privilege use, lateral movement, and outbound transfer without having to stitch the story together manually from disconnected tools.

Practitioner takeaway: The strongest defence against this kind of intrusion is not a single control, but a containment model that makes stolen access hard to reuse, easy to detect, and costly to move beyond its first foothold.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• How can organisations defend against Mustang Panda?
• How can organisations defend against Putter Panda?
• How can organisations defend against Aquatic Panda?
• How should organisations defend against attack-as-a-service identity fraud?