Skip to content

Aquatic Panda

IntrusionSet · ATTACK:enterprise:G0143

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G0143",
  "title": "Aquatic Panda",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0143",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--64b52e7d-b2c4-4a02-9372-08a463f5dc11",
  "external_id": "G0143",
  "domain": "enterprise",
  "created": "2022-01-18T14:49:29.505Z",
  "modified": "2026-07-31T18:47:58.464Z",
  "version": "2.0",
  "aliases": [
    "Aquatic Panda"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CrowdStrike AQUATIC PANDA December 2021",
      "url": "https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"
    }
  ]
}

Explicit source assertions (41)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--010ee4a6-41cb-4ce5-8dc2-9a1d1003ec4e

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1087

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02b38264-044a-47ee-b8d8-a08cbb115d06

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02bd0dd0-85cb-439c-a984-973bed485f8e

Crowdstrike HuntReport 2022 · CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--077bd0e4-5279-4409-89ab-9885bcc0ae85

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10a3e014-047a-4b6a-b8f2-6297f0043ab9

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--120d84d1-e769-421d-8743-645b024d292b

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14398d6b-aeb3-4d7c-9c65-9dfa1ab162ce

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1574.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--165336dd-529c-4ec0-a7ff-2608a42fa16c

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1070.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17257faf-d3a8-4959-9743-aa118902106c

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fbee829-fe84-4a48-a943-5be81abfb43c

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--245c2bf3-f630-4850-8fef-9580f5672b02

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38230234-1111-41cf-aa6b-b107577dad61

Crowdstrike HuntReport 2022 · CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0141

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--419d2655-2c6e-4fbe-ad2d-e2e84aec61e0

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--478afd21-5bbe-4e85-9fb8-fcdb89e1a3de

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--479a4e37-811b-44e7-9d4f-e226eece6c36

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52ed39dd-0f4c-4e30-8b3b-7eb75b5c87e3

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ba11730-a404-4252-aefe-acbf71877b0c

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1654

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72c13b6e-3134-4b0f-a51b-123db35ae080

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73cead10-011c-4131-a3dd-2858892ba1cb

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77f8ae7e-c2a1-4c9e-95fd-e886ab57a218

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e3bef4f-f75a-42a2-bb77-df7b44a322d4

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1588.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82697b12-31e0-4a9f-a394-d5555b0da05f

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--833c9993-3551-45af-9bbd-413de2d4dac3

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ca9a16d-d54d-415c-b048-96be71a52966

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95ba226b-11a7-441e-ba6f-2d4f243dffdd

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98a50c7b-353d-4bbd-bd66-799d79b389a0

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98d908da-f2b1-47f8-a74a-41984e88f55e

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0385

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c0bf8de-7366-46a4-a1b9-b6a72937c8db

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e2b7623-69e9-4c03-a4da-df281e99f663

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba215171-4b5b-407f-931e-0d97ddb64909

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1595.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcd8dfe5-6f81-406c-a06a-7aa83db91a5e

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0596

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2eb1354-acae-4452-81dc-72af72ecd2a3

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c417561d-d3fa-4aa7-b272-6769b2ada225

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1021

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cadbc1b1-aa69-4120-982e-cb306143d759

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf629c11-56bd-4804-a03a-311689060c85

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de6db2bf-4ccf-4103-83a5-424ca960fede

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de96f11c-1e26-4438-8332-9b4ab4fa6cde

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1078.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df0f23e4-79c0-40e5-88ea-0ec4f07302d2

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0d8b438-c7be-43b3-ba3f-9dd61c0e54cb

Crowdstrike HuntReport 2022 · CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f57dc789-e35e-4336-8935-9e1b7eca0324

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5d63c0b-0857-4382-9f45-c45beba57737

Crowdstrike HuntReport 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.