I am Ironman: DEEP PANDA Uses Sakula Malware to Target Organizations in Multiple Sectors » Adversary Manifesto

**Executive Summary:** CrowdStrike tracked a DEEP PANDA campaign (Apr–Sep 2014) that used malicious droppers masquerading as legitimate installers to deploy Sakula and Derusbi RATs via DLL side‑loading, signed with stolen certificates; victims included organizations in the U.S. defense industrial base, healthcare, government, and IT sectors, with observable C2 domains/IPs, spoofed login pages, and relationships to Scanbox activity.