{
	"id": "d9f8520a-23e5-4cac-a9fd-9f55e184283a",
	"created_at": "2026-04-06T00:20:53.774621Z",
	"updated_at": "2026-04-10T03:34:52.502508Z",
	"deleted_at": null,
	"sha1_hash": "c2f76bd5c715dc7f16d6b04fa9a80c1a39adda67",
	"title": "Aquatic Panda - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48059,
	"plain_text": "Aquatic Panda - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-05 16:11:23 UTC\nHome \u003e List all groups \u003e Aquatic Panda\n APT group: Aquatic Panda\nNames\nAquatic Panda (CrowdStrike)\nG0143 (MITRE)\nCountry China\nMotivation Information theft and espionage\nFirst seen 2020\nDescription\n(CrowdStrike) AQUATIC PANDA is a China-based targeted intrusion adversary with a dual\nmission of intelligence collection and industrial espionage. It has likely operated since at least\nMay 2020. AQUATIC PANDA operations have primarily focused on entities in the\ntelecommunications, technology and government sectors. AQUATIC PANDA relies heavily on\nCobalt Strike, and its toolset includes the unique Cobalt Strike downloader tracked as\nFishMaster. AQUATIC PANDA has also been observed delivering njRAT payloads to targets.\nObserved Sectors: Government, Technology, Telecommunications.\nTools used Cobalt Strike, Fishmaster, njRAT.\nInformation\nLast change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=0730437a-1b64-4777-a920-64bbe97214c0\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=0730437a-1b64-4777-a920-64bbe97214c0\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=0730437a-1b64-4777-a920-64bbe97214c0"
	],
	"report_names": [
		"showcard.cgi?u=0730437a-1b64-4777-a920-64bbe97214c0"
	],
	"threat_actors": [
		{
			"id": "610a7295-3139-4f34-8cec-b3da40add480",
			"created_at": "2023-01-06T13:46:38.608142Z",
			"updated_at": "2026-04-10T02:00:03.03764Z",
			"deleted_at": null,
			"main_name": "Cobalt",
			"aliases": [
				"Cobalt Group",
				"Cobalt Gang",
				"GOLD KINGSWOOD",
				"COBALT SPIDER",
				"G0080",
				"Mule Libra"
			],
			"source_name": "MISPGALAXY:Cobalt",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "19935e32-f1a5-462d-8934-8b1c3bf3b5f2",
			"created_at": "2022-10-25T16:07:23.36465Z",
			"updated_at": "2026-04-10T02:00:04.565476Z",
			"deleted_at": null,
			"main_name": "Aquatic Panda",
			"aliases": [
				"G0143"
			],
			"source_name": "ETDA:Aquatic Panda",
			"tools": [
				"Agentemis",
				"Bladabindi",
				"Cobalt Strike",
				"CobaltStrike",
				"Fishmaster",
				"JollyJellyfish",
				"Jorik",
				"cobeacon",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "9f101d9c-05ea-48b9-b6f1-168cd6d06d12",
			"created_at": "2023-01-06T13:46:39.396409Z",
			"updated_at": "2026-04-10T02:00:03.312816Z",
			"deleted_at": null,
			"main_name": "Earth Lusca",
			"aliases": [
				"CHROMIUM",
				"ControlX",
				"TAG-22",
				"BRONZE UNIVERSITY",
				"AQUATIC PANDA",
				"RedHotel",
				"Charcoal Typhoon",
				"Red Scylla",
				"Red Dev 10",
				"BountyGlad"
			],
			"source_name": "MISPGALAXY:Earth Lusca",
			"tools": [
				"RouterGod",
				"SprySOCKS",
				"ShadowPad",
				"POISONPLUG",
				"Barlaiy",
				"Spyder",
				"FunnySwitch"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "ba3eea09-ce30-4cfa-ae3a-b5992c4b81f8",
			"created_at": "2022-10-25T15:50:23.441443Z",
			"updated_at": "2026-04-10T02:00:05.263145Z",
			"deleted_at": null,
			"main_name": "Aquatic Panda",
			"aliases": [
				"Aquatic Panda"
			],
			"source_name": "MITRE:Aquatic Panda",
			"tools": [
				"Wevtutil",
				"Winnti for Windows",
				"njRAT",
				"Cobalt Strike",
				"ShadowPad",
				"Winnti for Linux"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "18a7b52d-a1cd-43a3-8982-7324e3e676b7",
			"created_at": "2025-08-07T02:03:24.688416Z",
			"updated_at": "2026-04-10T02:00:03.734754Z",
			"deleted_at": null,
			"main_name": "BRONZE UNIVERSITY",
			"aliases": [
				"Aquatic Panda",
				"Aquatic Panda ",
				"CHROMIUM",
				"CHROMIUM ",
				"Charcoal Typhoon",
				"Charcoal Typhoon ",
				"Earth Lusca",
				"Earth Lusca ",
				"FISHMONGER ",
				"Red Dev 10",
				"Red Dev 10 ",
				"Red Scylla",
				"Red Scylla ",
				"RedHotel",
				"RedHotel ",
				"Tag-22",
				"Tag-22 "
			],
			"source_name": "Secureworks:BRONZE UNIVERSITY",
			"tools": [
				"Cobalt Strike",
				"Fishmaster",
				"FunnySwitch",
				"Spyder",
				"njRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775434853,
	"ts_updated_at": 1775792092,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c2f76bd5c715dc7f16d6b04fa9a80c1a39adda67.pdf",
		"text": "https://archive.orkl.eu/c2f76bd5c715dc7f16d6b04fa9a80c1a39adda67.txt",
		"img": "https://archive.orkl.eu/c2f76bd5c715dc7f16d6b04fa9a80c1a39adda67.jpg"
	}
}