Skip to content
skopnix
← Adversaries

File · Aquatic Panda · Unknown · refreshed 2026-10-18

Aquatic Panda

MITRE G0143 ↗

Aquatic Panda — ATT&CK roseAP

attack rose · 35 techniques across 11 tactics

Analyst brief

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

35 techniques · 11 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    2 techniques

  3. Execution

    4 techniques

  4. Persistence

    1 technique

  5. Stealth

    9 techniques

  6. Defense impairment

    3 techniques

  7. Credential access

    1 technique

  8. Discovery

    6 techniques

  9. Lateral movement

    5 techniques

  10. Collection

    2 techniques

  11. Command and control

    1 technique

select a technique

Arsenal

5 malware · 1 tools
Malware
Malware · 5ATT&CK
Winnti for WindowsS0141 ↗
njRATS0385 ↗
Cobalt StrikeS0154 ↗
ShadowPadS0596 ↗
Winnti for LinuxS0430 ↗
Tools
Tools · 1ATT&CK
WevtutilS0645 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Detections

15 rules · Sigma · QRadar · Cortex

  1. Behaviour (ATT&CK technique)

    LSASS memory dump via comsvcs.dll MiniDump (T1003.001)

    APT1 · APT15 · APT27 · APT28 · APT3 · APT32 · 39 more

    T1003.001conf 90SIGAQLXQL

  2. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 85 more

    T1105conf 80SIGAQLXQL

  3. Behaviour (ATT&CK technique)

    PowerShell download cradle executed from the command line (T1059.001)

    APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 81 more

    T1059.001conf 80SIGAQLXQL

  4. Behaviour (ATT&CK technique)

    Windows event log cleared with wevtutil (T1685.005)

    APT28 · APT32 · APT41 · Aquatic Panda · Chimera · ENERGETIC BEAR · 8 more

    T1685.005conf 80SIGAQLXQL

  5. Behaviour (ATT&CK technique)

    Microsoft Defender protection disabled via Set-MpPreference (T1685)

    APT2 · APT35 · APT41 · APT5 · Aquatic Panda · blackbyte · 27 more

    T1685conf 75SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

2 sources
  1. 1.attack.mitre.org/groups/G0143
  2. 2.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-…

Track Aquatic Panda on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.