Aquatic Panda
- ID
- G0143
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.[1]
Techniques used (35)
- T1003.001 LSASS Memory
- T1005 Data from Local System
- T1007 System Service Discovery
- T1021 Remote Services
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.004 SSH
- T1027.010 Command Obfuscation
- T1033 System Owner/User Discovery
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1047 Windows Management Instrumentation
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1078.002 Domain Accounts
- T1082 System Information Discovery
- T1087 Account Discovery
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1218.011 Rundll32
- T1518.001 Security Software Discovery
- T1543.003 Windows Service
- T1550.002 Pass the Hash
- T1560.001 Archive via Utility
- T1574.001 DLL
- T1574.006 Dynamic Linker Hijacking
- T1588.001 Malware
- T1588.002 Tool
- T1595.002 Vulnerability Scanning
- T1654 Log Enumeration
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
Software used (6)
- S0141 Winnti for Windows
- S0154 Cobalt Strike
- S0385 njRAT
- S0430 Winnti for Linux
- S0596 ShadowPad
- S0645 Wevtutil