{
  "id": "aquatic-panda",
  "name": "Aquatic Panda",
  "aliases": [],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Suspected China-based group",
      "src": [
        "mitre-g0143"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2020,
      "src": [
        "mitre-g0143"
      ],
      "conf": "medium",
      "note": "At least 2020"
    },
    {
      "k": "attack_id",
      "v": "G0143",
      "src": [
        "mitre-g0143"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.",
      "src": [
        "mitre-g0143"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 35,
      "src": [
        "mitre-g0143"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Cobalt Strike, njRAT, ShadowPad, Wevtutil, Winnti for Linux, Winnti for Windows",
      "src": [
        "mitre-g0143"
      ],
      "conf": "high",
      "note": "6 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0143)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/aquatic-panda.html",
  "sources": {
    "mitre-g0143": {
      "title": "Aquatic Panda, Group G0143",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0143/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}