Aquatic Panda
Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.
- ATT&CK ID
- G0143
- Origin
- China
- Techniques
- 25
- Tools
- 6
Techniques
Reconnaissance
Resource Development
Initial Access
Execution
Windows Management InstrumentationCommand and Scripting InterpreterHijack Execution Flow
Persistence
Valid AccountsModify RegistryCreate or Modify System Process
Privilege Escalation
Valid AccountsCreate or Modify System Process
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalValid AccountsSystem Binary Proxy ExecutionHijack Execution Flow
Defense Impairment
Modify RegistryDisable or Modify Tools
Credential Access
Discovery
System Service DiscoverySystem Owner/User DiscoverySystem Information DiscoveryAccount DiscoverySoftware DiscoveryLog Enumeration
Lateral Movement
Remote ServicesUse Alternate Authentication Material
Collection
Data from Local SystemArchive Collected Data
Command and Control
Software
Cobalt Strike · ShadowPad · Wevtutil · Winnti for Linux · Winnti for Windows · njRAT