MITRE ATT&CKgroup
G0143 Aquatic Panda
- Domain
- enterprise
- Version
- 2.0
- Created
- 2022-01-18
Description
Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.
Related
Uses · MITRE ATT&CK (41)
- T1685 Disable or Modify Tools technique
- T1685.005 Clear Windows Event Logs sub-technique
- T1654 Log Enumeration technique
- T1027.010 Command Obfuscation sub-technique
- S0645 Wevtutil software (tool)
- S0596 ShadowPad software (malware)
- T1595.002 Vulnerability Scanning sub-technique
- T1588.001 Malware sub-technique
- T1588.002 Tool sub-technique
- S0430 Winnti for Linux software (malware)
- T1078.002 Domain Accounts sub-technique
- T1574.001 DLL sub-technique
- T1574.006 Dynamic Linker Hijacking sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.004 Unix Shell sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1560.001 Archive via Utility sub-technique
- T1003.001 LSASS Memory sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1021.004 SSH sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.003 Clear Command History sub-technique
- T1070.004 File Deletion sub-technique
- T1550.002 Pass the Hash sub-technique
- T1218.011 Rundll32 sub-technique
- T1543.003 Windows Service sub-technique
- S0385 njRAT software (malware)
References
- https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ CrowdStrike AQUATIC PANDA December 2021