H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Group

Aquatic Panda

[Aquatic Panda](https://attack.mitre.org/groups/G0143) is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org/groups/G0143) has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)

Group
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Aquatic Panda](https://attack.mitre.org/groups/G0143) is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org/groups/G0143) has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)

41 recorded

Relationships

uses
to Account Discovery
Technique
uses
to Archive via Utility
Technique
uses
to Clear Command History
Technique
uses
to Clear Windows Event Logs
Technique
uses
to Cobalt Strike
Malware
uses
to Command Obfuscation
Technique
uses
to Data from Local System
Technique
uses
to Disable or Modify Tools
Technique
uses
to DLL
Technique
uses
to Domain Accounts
Technique
uses
to Dynamic Linker Hijacking
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Log Enumeration
Technique
uses
to LSASS Memory
Technique
uses
to Malware
Technique
uses
to Masquerade Task or Service
Technique
uses
to Match Legitimate Resource Name or Location
Technique
uses
to Modify Registry
Technique
uses
to njRAT
Malware
uses
to Pass the Hash
Technique
uses
to PowerShell
Technique
uses
to Remote Desktop Protocol
Technique
uses
to Remote Services
Technique
uses
to Rundll32
Technique
uses
to Security Software Discovery
Technique
uses
to ShadowPad
Malware
uses
to SMB/Windows Admin Shares
Technique
uses
to SSH
Technique
uses
to System Information Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to System Service Discovery
Technique
uses
to Tool
Technique
uses
to Unix Shell
Technique
uses
to Vulnerability Scanning
Technique
uses
to Wevtutil
Tool
uses
to Windows Command Shell
Technique
uses
to Windows Management Instrumentation
Technique
uses
to Windows Service
Technique
uses
to Winnti for Linux
Malware
uses
to Winnti for Windows
Malware
2 external

References

mitre-attack
G0143
open
CrowdStrike AQUATIC PANDA December 2021
https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance