Aquatic Panda (G0143) | Threat Actor Index

35

Techniques

6

Toolsets

0

CVEs Referenced

0

KEV Entries

About Aquatic Panda

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.

View MITRE record ↗

Techniques by Tactic (35)

Reconnaissance

T1595.002 Vulnerability Scanning

Resource Development

T1588.001 MalwareT1588.002 Tool

Initial Access

T1078.002 Domain Accounts

Execution

T1047 Windows Management InstrumentationT1059.001 PowerShellT1059.003 Windows Command ShellT1059.004 Unix ShellT1574.001 DLLT1574.006 Dynamic Linker Hijacking

Persistence

T1078.002 Domain AccountsT1112 Modify RegistryT1543.003 Windows Service

Privilege Escalation

T1078.002 Domain AccountsT1543.003 Windows Service

Stealth

T1027.010 Command ObfuscationT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1070.003 Clear Command HistoryT1070.004 File DeletionT1078.002 Domain AccountsT1218.011 Rundll32T1574.001 DLLT1574.006 Dynamic Linker Hijacking

Defence Impairment

T1112 Modify RegistryT1685 Disable or Modify ToolsT1685.005 Clear Windows Event Logs

Credential Access

T1003.001 LSASS Memory

Discovery

T1007 System Service DiscoveryT1033 System Owner/User DiscoveryT1082 System Information DiscoveryT1087 Account DiscoveryT1518.001 Security Software DiscoveryT1654 Log Enumeration

Lateral Movement

T1021 Remote ServicesT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1021.004 SSHT1550.002 Pass the Hash

Collection

T1005 Data from Local SystemT1560.001 Archive via Utility

Command & Control

T1105 Ingress Tool Transfer

Toolsets (6)

🐛

Cobalt Strike S0154

Malware · Linux, macOS, Windows

🐛

ShadowPad S0596

Malware · Windows

🐛

Winnti for Linux S0430

Malware · Linux

🐛

Winnti for Windows S0141

Malware · Windows

🐛

njRAT S0385

Malware · Windows

🔧

Wevtutil S0645

Tool · Windows

References & Reports (1)

Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retr

↑