Home / Threat actors / Aquatic Panda

Aquatic Panda G0143

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

42

Techniques

6

Malware and tools

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance

T1595.002 Vulnerability Scanning

Resource Development

T1588.001 Malware T1588.002 Tool

Initial Access

T1078.002 Domain Accounts

Execution

T1047 Windows Management Instrumentation T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 Unix Shell T1574.001 DLL T1574.006 Dynamic Linker Hijacking

Persistence

T1078.002 Domain Accounts T1112 Modify Registry T1543.003 Windows Service

Privilege Escalation

T1078.002 Domain Accounts T1543.003 Windows Service

Stealth

T1027.010 Command Obfuscation T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1070.003 Clear Command History T1070.004 File Deletion T1078.002 Domain Accounts T1218.011 Rundll32 T1574.001 DLL T1574.006 Dynamic Linker Hijacking

Defense Impairment

T1112 Modify Registry T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs

Credential Access

T1003.001 LSASS Memory

Discovery

T1007 System Service Discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1087 Account Discovery T1518.001 Security Software Discovery T1654 Log Enumeration

Lateral Movement

T1021 Remote Services T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.004 SSH T1550.002 Pass the Hash

Collection

T1005 Data from Local System T1560.001 Archive via Utility

Command and Control

T1105 Ingress Tool Transfer

Malware and tools

Cobalt StrikeMalwareS0154
njRATMalwareS0385
ShadowPadMalwareS0596
Winnti for LinuxMalwareS0430
Winnti for WindowsMalwareS0141
WevtutilToolS0645

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.