Aquatic Panda used thelast command in Linux environments to identify recently logged-in users on victim machines.^[2]

Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).^[1]

Aquatic Panda has used several publicly available tools, including WinRAR and 7zip, to compress collected files and memory dumps prior to exfiltration.^[1][2]

Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.^[1]

Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them tocmd /C.^[1]

Aquatic Panda used malicious shell scripts in Linux environments following access via SSH to install Linux versions of Winnti malware.^[2]

Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.^[2]

Aquatic Panda captured local Windows security event log data from victim machines using thewevtutil utility to extract contents to anevtx output file.^[2]

Aquatic Panda has used DLL search-order hijacking to loadexe,dll, anddat files into memory.^[1]Aquatic Panda loaded a malicious DLL into the legitimate Windows Security Health Service executable (SecurityHealthService.exe) to execute malicious code on victim systems.^[2]

Aquatic Panda modified theld.so preload file in Linux environments to enable persistence for Winnti malware.^[2]

Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.^[1]

Aquatic Panda clears Windows Event Logs following activity to evade defenses.^[2]

Aquatic Panda cleared command history in Linux environments to remove traces of activity after operations.^[2]

Aquatic Panda has deleted malicious executables from compromised machines.^[1][2]

Aquatic Panda has downloaded additional malware onto compromised hosts.^[1]

Aquatic Panda enumerated logs related to authentication in Linux environments prior to deleting selective entries for defense evasion purposes.^[2]

Aquatic Panda created new, malicious services using names such asWindows User Service to attempt to blend in with legitimate items on victim systems.^[2]

Aquatic Panda renamed or moved malicious binaries to legitimate locations to evade defenses and blend into victim environments.^[2]

Aquatic Panda modified the victim registry to enable theRestrictedAdmin mode feature, allowing for pass the hash behaviors to function via RDP.^[2]

Aquatic Panda has encoded PowerShell commands in Base64.^[1]

Aquatic Panda has acquired and usednjRAT in its operations.^[1]

Aquatic Panda has acquired and usedCobalt Strike in its operations.^[1]

Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.^[1]

Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.^[2]

Aquatic Panda leveraged stolen credentials to move laterally via RDP in victim environments.^[2]

Aquatic Panda used remote shares to enable lateral movement in victim environments.^[2]

Aquatic Panda used SSH with captured user credentials to move laterally in victim environments.^[2]

Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.^[1]

Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.^[2]

Aquatic Panda has used native OS commands to understand privilege levels and system details.^[1]

Aquatic Panda gathers information on recently logged-in users on victim devices.^[2]

Aquatic Panda has attempted to discover services for third party EDR products.^[1]

Aquatic Panda used a registry edit to enable a Windows feature calledRestrictedAdmin in victim environments. This change allowedAquatic Panda to leverage "pass the hash" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.^[2]

Aquatic Panda used multiple mechanisms to capture valid user accounts for victim domains to enable lateral movement and access to additional hosts in victim environments.^[2]

Aquatic Panda used WMI for lateral movement in victim environments.^[2]