Introduction
Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors. CrowdStrike AQUATIC PANDA December 2021
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1027.010 Command Obfuscation
- T1087 Account Discovery
- T1070.004 File Deletion
- T1059.004 Unix Shell
- T1021.002 SMB/Windows Admin Shares
- T1036.004 Masquerade Task or Service
- T1574.006 Dynamic Linker Hijacking
- T1070.003 Clear Command History
- T1543.003 Windows Service
- T1550.002 Pass the Hash
- T1574.001 DLL
- T1021.001 Remote Desktop Protocol
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1007 System Service Discovery
- T1654 Log Enumeration
- T1021.004 SSH
- T1112 Modify Registry
- T1036.005 Match Legitimate Resource Name or Location
- T1588.001 Malware
- T1518.001 Security Software Discovery
- T1059.003 Windows Command Shell
- T1685 Disable or Modify Tools
- T1033 System Owner/User Discovery
- T1047 Windows Management Instrumentation
- T1588.002 Tool
- T1595.002 Vulnerability Scanning
- T1003.001 LSASS Memory
- T1021 Remote Services
- T1082 System Information Discovery
- T1218.011 Rundll32
- T1685.005 Clear Windows Event Logs
- T1078.002 Domain Accounts
- T1560.001 Archive via Utility
- T1059.001 PowerShell
ATT&CK technique IDs (denormalized)
- T1003.001
- T1005
- T1007
- T1021
- T1021.001
- T1021.002
- T1021.004
- T1027.010
- T1033
- T1036.004
- T1036.005
- T1047
- T1059.001
- T1059.003
- T1059.004
- T1070.003
- T1070.004
- T1078.002
- T1082
- T1087
- T1105
- T1112
- T1218.011
- T1518.001
- T1543.003
- T1550.002
- T1560.001
- T1574.001
- T1574.006
- T1588.001
- T1588.002
- T1595.002
- T1654
- T1685
- T1685.005
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- Wevtutil (S0645) — tool
- Winnti for Windows (S0141) — malware
- njRAT (S0385) — malware
- Cobalt Strike (S0154) — malware
- ShadowPad (S0596) — malware
- Winnti for Linux (S0430) — malware
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [2] CrowdStrike AQUATIC PANDA December 2021 Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.