Aquatic Panda - Threat Group Cards: A Threat Actor
Encyclopedia
Archived: 2026-04-05 16:11:23 UTC
Home > List all groups > Aquatic Panda
 APT group: Aquatic Panda
Names
Aquatic Panda (CrowdStrike)
G0143 (MITRE)
Country China
Motivation Information theft and espionage
First seen 2020
Description
(CrowdStrike) AQUATIC PANDA is a China-based targeted intrusion adversary with a dual
mission of intelligence collection and industrial espionage. It has likely operated since at least
May 2020. AQUATIC PANDA operations have primarily focused on entities in the
telecommunications, technology and government sectors. AQUATIC PANDA relies heavily on
Cobalt Strike, and its toolset includes the unique Cobalt Strike downloader tracked as
FishMaster. AQUATIC PANDA has also been observed delivering njRAT payloads to targets.
Observed Sectors: Government, Technology, Telecommunications.
Tools used Cobalt Strike, Fishmaster, njRAT.
Information
Last change to this card: 16 August 2025
Download this actor card in PDF or JSON format
Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=0730437a-1b64-4777-a920-64bbe97214c0
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=0730437a-1b64-4777-a920-64bbe97214c0
Page 1 of 1