What tactics and techniques does Deep Panda use?

How Deep Panda typically gets initial access and stays quiet

deep panda’s playbook is built around getting a foothold without drawing attention, then turning that foothold into broader access. The mix of spearphishing, exploitation and credential theft is important because it lets the group choose the easiest path into a target, rather than relying on one repeatable exploit chain. That makes initial detection harder and increases the chance that the first alert appears only after internal movement has already begun.

The group’s preference for stealth means defenders should expect low-noise activity rather than obviously destructive behaviour. After compromise, legitimate remote administration, approved tools and ordinary user paths can be abused to blend in with normal operations, which is why behavioural context matters more than single suspicious events.

For deeper background on how intrusion sets are named and tracked, Threat Actor Groups Guide explains how group intelligence, aliases and vendor naming schemes are used in practice.

What techniques matter most after the first compromise

Once inside, the key techniques are lateral movement, collection activity and living-off-the-land tradecraft. Lateral movement matters because the attacker is no longer trying to break in, but to widen access across systems, identities and data stores while keeping a low profile. Collection activity is the stage where the intruder looks for mailboxes, file shares, repositories or other sources of valuable content.

Using legitimate tools after compromise is not a separate novelty, it is what makes the operation resilient. Remote-management utilities, admin consoles and trusted scripts can all become covert transport for commands, data access or internal reconnaissance. The practical implication is that defenders need to watch for unusual use, not just unusual binaries.

The same pattern appears in phishing-led intrusion paths, where the goal is often to convert a single successful lure into session theft or credential abuse. The Top 10 Phishing Techniques resource is useful when you want to connect the initial lure to the follow-on abuse path.

How defenders should map the tactics to detection and response

The useful defensive lens is to treat Deep Panda as an intrusion set that prefers valid access paths, then hides inside them. That means authentication logs, privileged account use, remote-management telemetry and repository access patterns should be correlated together, not reviewed as isolated alerts. If the same account shows unusual geography, timing, device context or sequence of actions, that is often more meaningful than a single failed login or a lone administrative command.

Response quality depends on knowing which accounts, tools and repositories matter most before an incident starts. Restricting privileged access, hardening remote administration and flagging abnormal access to sensitive stores are high-value controls because they reduce both the chance of quiet expansion and the size of the target surface once the attacker is already inside.

For a technique-level view of how these intrusions are mapped by the broader threat community, MITRE ATT&CK Enterprise Matrix provides a reference for credential access, lateral movement and collection patterns.

Risk and Threat Considerations

Deep Panda’s technique mix is risky because it combines low-friction entry with low-noise expansion. If defenders focus only on malware signatures or perimeter blocks, they can miss the more durable part of the campaign, which is the abuse of valid credentials, trusted tools and ordinary administration channels.

Failure mechanism: Spearphishing, exploitation or credential theft creates a legitimate-looking starting point, then lateral movement and collection proceed through trusted internal paths that are harder to separate from routine activity.

Impact: The attacker can reach more systems, harvest more data and remain present longer, while the organisation may only discover the compromise after sensitive repositories or privileged accounts have already been touched.

Practitioner Guidance

What to verify: Confirm that authentication telemetry, remote-management logs and privileged access records are centralised and reviewable together. If those data sets are fragmented, you will struggle to distinguish normal administrative activity from attacker movement.

Decision rule: If an account can reach sensitive repositories or perform remote administration, treat abnormal use of that account as a containment trigger, even if the activity appears to use approved tools.

Practitioner takeaway: The main challenge is not spotting exotic malware, it is recognising when ordinary credentials and ordinary tools are being used for an abnormal internal campaign.

Related resources from NHI Mgmt Group

• What tactics and techniques does Mustang Panda use?
• What tactics and techniques does Putter Panda use?
• What tactics and techniques does Aquatic Panda use?
• What tactics and techniques do Lazarus crypto heists use?