NEW: Group Profiler — instant APT intel lookup. Try it →

← threatfilter.dev / all groups / Aquatic Panda

Aquatic Panda

G0143 China MITRE ATT&CK →

Overview

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.

Targets

Covid-19 Research Organizations · Cryptocurrency · Education · Gambling Companies · Government Institutions · Media · Medical · Pro-democracy And Human Rights Political Organizations · Religious Organization · Telecommunications

Regions

Australia · China · France · Germany · Hong Kong · Japan · Mongolia · Nepal · Nigeria · Philippines · Taiwan · Thailand · United Arab Emirates · United States · Vietnam

Capabilities

Custom malware/implant development — ATT&CK: 5 attributed custom malware families

TTPs — 35 techniques across 11 tactics

Reconnaissance

T1595.002 Vulnerability Scanning

Resource Development

T1588.001 Malware
T1588.002 Tool

Execution

T1047 Windows Management Instrumentation
T1059.001 PowerShell
T1059.003 Windows Command Shell
T1059.004 Unix Shell

Persistence

T1543.003 Windows Service

Stealth

T1027.010 Command Obfuscation
T1036.004 Masquerade Task or Service
T1036.005 Match Legitimate Resource Name or Location
T1070.003 Clear Command History
T1070.004 File Deletion
T1078.002 Domain Accounts
T1218.011 Rundll32
T1574.001 DLL
T1574.006 Dynamic Linker Hijacking

Defense Impairment

Credential Access

T1003.001 LSASS Memory

Discovery

Lateral Movement

T1021 Remote Services
T1021.001 Remote Desktop Protocol
T1021.002 SMB/Windows Admin Shares
T1021.004 SSH
T1550.002 Pass the Hash

Collection

T1005 Data from Local System
T1560.001 Archive via Utility

Command and Control

T1105 Ingress Tool Transfer

Tools & malware (6)

Wevtutil · Winnti for Windows · njRAT · Cobalt Strike · ShadowPad · Winnti for Linux

Reporting (1)

OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt — Wiley, B. et al