Dark Web Profile: Aquatic Panda

MITRE Techniques

• [T1087] Account Discovery – Aquatic Panda used Linux ‘last’ command to identify recently logged-in users (“used the last command in Linux to identify recently logged-in users”).
• [T1595.002] Active Scanning: Vulnerability Scanning – The group used public DNS logging services to detect Log4j vulnerable servers (CVE-2021-44228) (“Used public DNS logging services to find servers vulnerable to Log4j”).
• [T1560.001] Archive Collected Data: Archive via Utility – Data compression before exfiltration was done with WinRAR and 7-Zip (“Compressed files and dumps with WinRAR and 7-Zip before exfiltration”).
• [T1059.001] Command and Scripting Interpreter: PowerShell – PowerShell was used to download and execute Base64-encoded scripts (“Downloaded scripts and executed Base64 encoded commands in PowerShell”).
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – Executed Bash commands on Windows via cmd /C (“Attempted to run Bash commands via cmd /C on Windows”).
• [T1059.004] Command and Scripting Interpreter: Unix Shell – Malicious shell scripts installed Linux Winnti backdoors post SSH access (“Used malicious shell scripts post-SSH access to install Linux versions of Winnti”).
• [T1543.003] Create or Modify System Process: Windows Service – Created fake Windows services for persistence (“Created Windows services mimicking legitimate ones for persistence”).
• [T1005] Data from Local System – Captured Windows security logs using wevtutil (“Captured Windows security logs using wevtutil”).
• [T1574.001] Hijack Execution Flow: DLL Search Order Hijacking – Loaded malicious DLLs via hijacking search order (“Used search-order hijacking to load malicious files and DLLs into trusted processes”).
• [T1574.006] Hijack Execution Flow: Dynamic Linker Hijacking – Modified Linux ld.so preload for persistence (“Modified ld.so preload in Linux for Winnti persistence”).
• [T1562.001] Impair Defenses: Disable or Modify Tools – Attempted to disable endpoint detection and response tools (“Attempted to disable EDR tools”).
• [T1070.001] Indicator Removal: Clear Windows Event Logs – Removed logs to evade detection (“Cleared Windows Event Logs to evade detection”).
• [T1070.003] Indicator Removal: Clear Command History – Cleared Linux shell command histories (“Cleared shell command history in Linux”).
• [T1070.004] Indicator Removal: File Deletion – Deleted malware artifacts from hosts (“Deleted malware from compromised hosts”).
• [T1105] Ingress Tool Transfer – Downloaded malware onto compromised environments (“Downloaded malware onto compromised systems”).
• [T1654] Log Enumeration – Enumerated authentication logs before selective deletion (“Enumerated authentication logs before selective deletion for evasion”).
• [T1036.004] Masquerading: Masquerade Task or Service – Used service names like “Windows User Service” to blend in (“Created services like “Windows User Service” to blend in”).
• [T1036.005] Masquerading: Match Legitimate Name or Location – Renamed or relocated binaries to avoid detection (“Renamed or relocated binaries to evade detection”).
• [T1112] Modify Registry – Enabled RestrictedAdmin mode for pass-the-hash via RDP (“Enabled RestrictedAdmin mode for pass-the-hash via RDP”).
• [T1027.010] Obfuscated Files or Information: Command Obfuscation – Encoded PowerShell commands in Base64 (“Encoded PowerShell commands in Base64”).
• [T1588.001] Obtain Capabilities: Malware – Used njRAT to gain capabilities (“Acquired and used njRAT”).
• [T1588.002] Obtain Capabilities: Tool – Used Cobalt Strike tool (“Acquired and used Cobalt Strike”).
• [T1003.001] OS Credential Dumping: LSASS Memory – Attempted credential theft from LSASS memory (“Attempted credential theft from LSASS memory”).
• [T1021] Remote Services – Used remote scheduled tasks for malware deployment (“Used remote scheduled tasks to deploy malware”).
• [T1021.001] Remote Services: Remote Desktop Protocol – Lateral movement via RDP with stolen credentials (“Moved laterally via RDP using stolen credentials”).
• [T1021.002] Remote Services: SMB/Windows Admin Shares – Enabled lateral movement via SMB/admin shares (“Enabled lateral movement using admin shares”).
• [T1021.004] Remote Services: SSH – Used SSH to move laterally after credential theft (“Used SSH with stolen credentials for lateral movement”).
• [T1518.001] Software Discovery: Security Software Discovery – Searched for third-party endpoint detection and response (EDR) products (“Searched for third-party EDR software”).
• [T1218.011] System Binary Proxy Execution: Rundll32 – Used rundll32.exe to run a malicious DLL keylogger (“Used rundll32.exe to execute a malicious keylogger DLL”).
• [T1082] System Information Discovery – Ran OS commands to gather system information and privileges (“Ran native OS commands to assess privileges and system info”).
• [T1033] System Owner/User Discovery – Collected data on logged-in users (“Collected info on logged-in users”).
• [T1007] System Service Discovery – Searched for services related to security software (“Searched for services related to EDR”).
• [T1550.002] Use Alternate Authentication Material: Pass the Hash – Leveraged pass-the-hash via RestrictedAdmin mode (“Modified registry for RestrictedAdmin, enabling hash-based RDP login”).
• [T1078.002] Valid Accounts: Domain Accounts – Gathered domain credentials for lateral movement (“Gathered valid domain credentials for lateral movement”).
• [T1047] Windows Management Instrumentation – Used WMI for lateral movement (“Used WMI for lateral movement”).