Aquatic Panda

OriginChina

Techniques (MITRE ATT&CK)35

SourceMITRE ATT&CK

Vexday analysis

Aquatic Panda é um grupo APT de origem chinesa com dupla missão de coleta de inteligência e espionagem industrial, ativo pelo menos desde maio de 2020. Suas operações têm como alvos prioritários entidades dos setores de telecomunicações, tecnologia e governo. O grupo é rastreado pelo MITRE ATT&CK sob o identificador G0143, com 35 técnicas documentadas atribuídas ao seu arsenal.

Techniques (MITRE ATT&CK) 35

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Vulnerability Scanning

Resource development

Malware Tool

Execution

Windows Management Instrumentation PowerShell Windows Command Shell Unix Shell

Persistence

Windows Service

Credential access

LSASS Memory

Discovery

System Service Discovery System Owner/User Discovery System Information Discovery Account Discovery Security Software Discovery Log Enumeration

Lateral movement

Remote Services Remote Desktop Protocol SMB/Windows Admin Shares SSH Pass the Hash

Collection

Data from Local System Archive via Utility

Command and control

Ingress Tool Transfer

defense-impairment

Modify Registry Disable or Modify Tools Clear Windows Event Logs

stealth

Command Obfuscation Masquerade Task or Service Match Legitimate Resource Name or Location Clear Command History File Deletion Domain Accounts Rundll32 DLL Dynamic Linker Hijacking

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Aquatic Panda uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →