defection.io

group

Aquatic Panda G0143

Created: 18 January 2022
Last modified: 31 July 2026
Alias: Aquatic Panda

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.[1]

Techniques71st pct

TacticsTop 15%

Tools & malware67th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

group

Aquatic Panda G0143

Created: 18 January 2022
Last modified: 31 July 2026
Alias: Aquatic Panda

Techniques71st pct

TacticsTop 15%

Tools & malware67th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Aquatic Panda MITRE reference G0143

LSASS Memory T1003.001 ↗

Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.2

Credential Access90 detection rules

Data from Local System T1005 ↗

Aquatic Panda captured local Windows security event log data from victim machines using the wevtutil utility to extract contents to an evtx output file.3

Collection22 detection rules

System Service Discovery T1007 ↗

Aquatic Panda has attempted to discover services for third party EDR products.4

Discovery13 detection rules

Remote Services T1021 ↗

Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.5

Lateral Movement16 detection rules

Remote Desktop Protocol T1021.001 ↗

Aquatic Panda leveraged stolen credentials to move laterally via RDP in victim environments.6

Lateral Movement33 detection rules

SMB/Windows Admin Shares T1021.002 ↗

Aquatic Panda used remote shares to enable lateral movement in victim environments.7

Lateral Movement54 detection rules

Standing G0143

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques3571st pct

71st percentile · 71% of 176 ATT&CK groups have this many Enterprise techniques or fewer.

Tactics13Top 15%

85th percentile · 85% of 176 ATT&CK groups have this many tactics spanned or fewer.

Tools & malware667th pct

67th percentile · 67% of 176 ATT&CK groups have this many tools and malware or fewer.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique22med59th pct

59th percentile · 59% of 176 ATT&CK groups have this many detection rules per technique or fewer.

Tests / technique6medTop 16%

84th percentile · 84% of 176 ATT&CK groups have this many atomic tests per technique or fewer.

Data comps / technique4med65% tie · 12 values

65% of the population shares a single value across only 12 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique2med43% tie · 11 values

43% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this group’s 35 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 1153Splunk ESCU (cumulative) · 537