Aquatic Panda

· ATT&CK GroupG0143

Techniques

Software

Tactics

Aliases

Description

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)

Tactic Coverage

stealth (9)discovery (6)execution (6)lateral movement (5)persistence (3)defense impairment (3)collection (2)privilege escalation (2)resource development (2)credential access (1)initial access (1)command and control (1)reconnaissance (1)

Techniques Used (35)

T1003.001LSASS Memory

credential access

T1005Data from Local System

collection

T1007System Service Discovery

discovery

T1021Remote Services

lateral movement

T1021.001Remote Desktop Protocol

lateral movement

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 35 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (6)

S0154Cobalt Strikemalware S0596ShadowPadmalware S0645Wevtutiltool S0430Winnti for Linuxmalware S0141Winnti for Windowsmalware S0385njRATmalware

References (2)

https://attack.mitre.org/groups/G0143 https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/