Aquatic Panda
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Targets
Sectors: Government, Telecommunications
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1005Data from Local System
- T1007System Service Discovery
- T1021Remote Services
- T1021.001Remote Desktop Protocol
- T1021.002SMB/Windows Admin Shares
- T1021.004SSH
- T1027.010Command Obfuscation
- T1033System Owner/User Discovery
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location
- T1047Windows Management Instrumentation
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.004Unix Shell
- T1070.003Clear Command History
- T1070.004File Deletion
- T1078.002Domain Accounts
- T1082System Information Discovery
- T1087Account Discovery
- T1105Ingress Tool Transfer
- T1112Modify Registry
- T1218.011Rundll32
- T1518.001Security Software Discovery
- T1543.003Windows Service
- T1550.002Pass the Hash
- T1560.001Archive via Utility
- T1574.001DLL
- T1574.006Dynamic Linker Hijacking
- T1588.001Malware
- T1588.002Tool
- T1595.002Vulnerability Scanning
- T1654Log Enumeration
- T1685Disable or Modify Tools
- T1685.005Clear Windows Event Logs
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.