Aquatic Panda - G0143

Created: 2022-01-18T14:49:29.505Z

Modified: 2023-03-21T21:16:34.243Z

Contributors: NST Assure Research Team, NetSentries Technologies,Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation,Manikantan Srinivasan, NEC Corporation India

Aliases

Aquatic Panda

Description

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)

Techniques Used

Aquatic Panda has acquired and used

Cobalt Strike in its operations.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

Aquatic Panda has acquired and used

njRAT in its operations.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Aquatic Panda has used DLL search-order hijacking to load

Aquatic Panda has encoded PowerShell commands in Base64.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Aquatic Panda has used native OS commands to understand privilege levels and system details.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Aquatic Panda has attempted to discover services for third party EDR products.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to