Threat Group Cards: A Threat Actor Encyclopedia

APT group: Aquatic Panda

Names	Aquatic Panda (CrowdStrike)
Country	China
Motivation	Information theft and espionage
First seen	2020
Description	(CrowdStrike) AQUATIC PANDA is a China-based targeted intrusion adversary with a dual mission of intelligence collection and industrial espionage. It has likely operated since at least May 2020. AQUATIC PANDA operations have primarily focused on entities in the telecommunications, technology and government sectors. AQUATIC PANDA relies heavily on Cobalt Strike, and its toolset includes the unique Cobalt Strike downloader tracked as FishMaster. AQUATIC PANDA has also been observed delivering njRAT payloads to targets.
Observed	Sectors: Government, Technology, Telecommunications.
Tools used	Cobalt Strike, Fishmaster, njRAT.
Information	<https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/>

Last change to this card: 25 January 2022

Download this actor card in PDF or JSON format

Previous: APT 42
Next: AtlasCross