Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
35
techniques
6
software
10,819
corpus matches
profile
Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.
techniques
35 attributed · most-instrumented first
software
6 malware & tools attributed
Winnti for Windows
S0141
Cobalt Strike
S0154
njRAT
S0385
Winnti for Linux
S0430
ShadowPad
S0596
Wevtutil
S0645
read this carefully
10,819 corpus matches is not attribution
That count is indicators which exhibit techniques Aquatic Panda is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
+23 more techniques
showing 30 of 10,819