Aquatic Panda Threat Actor Profile: China Contractor Espionage, Tradecraft and Defences

Aquatic Panda turns a single unpatched server into long-term espionage access, and US authorities link the activity to a Chinese hacking contractor that sold stolen data to state ministries. This profile covers the China-based group that MITRE ATT&CK tracks as G0143, named by CrowdStrike and also tracked by Microsoft as part of Charcoal Typhoon and by ESET as FishMonger. It draws on MITRE ATT&CK v20, CrowdStrike, ESET, Microsoft's naming table and the US Justice Department's March 2025 announcement on the i-Soon case, and keeps each source's attribution wording. It is written for SOC analysts, incident responders and infrastructure owners in government, telecoms, technology, academia and civil society. It covers what to detect and harden on Windows and Linux, not how the malware works.

Key takeaways

• Fast exploitation of public flaws. CrowdStrike caught the group attacking a large academic institution through Log4Shell in VMware Horizon within days of the December 2021 disclosure.
• Stolen credentials do the spreading. ATT&CK records LSASS dumping, pass the hash over RDP after enabling RestrictedAdmin mode, and SSH with captured credentials on Linux.
• Logs are a target. The group clears Windows event logs, enumerates and selectively deletes Linux authentication logs and clears shell history, so logs must leave the host in real time.
• Both Windows and Linux are in scope. Winnti for Windows and Linux, ShadowPad and ld.so preload persistence mean Linux servers need the same EDR and integrity monitoring as Windows.
• A contractor ecosystem, not a single team. ESET assessed that FishMonger, which it says is also known as Earth Lusca, TAG-22, Aquatic Panda or Red Dev 10, is operated by i-Soon, and the Justice Department's March 2025 announcement links to an FBI wanted notice titled for Aquatic Panda cyber threat actors.

Who they are (names and aliases)

MITRE ATT&CK describes Aquatic Panda as a suspected China-based group with a dual mission of intelligence collection and industrial espionage, active since at least May 2020 and mainly targeting telecommunications, technology and government. CrowdStrike uses the same wording. Vendor names overlap but do not map one to one, so treat the table as clusters that sources say overlap, not as identical groups.

The i-Soon contractor link

On 5 March 2025 the US Justice Department announced charges against i-Soon personnel and Chinese Ministry of Public Security officers. The Department alleges that i-Soon, a nominally private company, hacked email accounts, phones, servers and websites from about 2016 to 2023, sometimes at the request of the Ministry of Public Security (MPS) and Ministry of State Security (MSS) and sometimes on its own initiative, then sold the data. It alleges sales to at least 43 MSS or MPS bureaus in 31 provinces and municipalities, fees of roughly US$10,000 to US$75,000 per successfully accessed inbox, and victims including US federal and state agencies, the foreign ministries of Taiwan, India, South Korea and Indonesia, religious organisations, news outlets and critics of the Chinese government. The charges are allegations. The Justice Department's announcement itself names APT27, not Aquatic Panda; the link to Aquatic Panda comes from the FBI wanted notice linked in that announcement and from ESET's own research. This page names no individuals. For APT27, see the APT27 Threat Actor Profile Guide; for the wider system, the China State Cyber Operations Guide.

Software associated in ATT&CK

For the shared backdoors, see the PlugX and ShadowPad Malware Guide.

Targeting and motivation

• Sectors: telecommunications, technology and government (ATT&CK, CrowdStrike), plus academia in the 2021 Log4Shell intrusion.
• Operation FishMedley (2022): ESET clustered seven compromises between January and October 2022 in Taiwan, Hungary, Turkey, Thailand, France and the United States, hitting two government bodies, two Catholic organisations, an NGO and a geopolitical think tank. ESET assesses with high confidence that FishMonger carried them out.
• Motivation: intelligence collection and industrial espionage. The Justice Department's case adds transnational repression of dissidents and critics as a purpose of i-Soon's wider work.
• Who should care: governments and foreign ministries, telecoms and technology firms, universities, religious and human rights groups, and media critical of Beijing.

Tactics and techniques (MITRE ATT&CK)

All IDs below are ATT&CK v20 techniques recorded against G0143. The full list is longer; this table groups the ones that matter most for defence.

Technique deep dives: T1003 OS Credential Dumping, MITRE ATT&CK T1550 Use Alternate Authentication Material and T1685 Disable or Modify Tools.

How they abuse identities and credentials

• LSASS as the credential store: ATT&CK and ESET both describe LSASS dumping, and ESET also saw SAM and SYSTEM hive copies. Credential Guard and LSA protection reduce what a dump yields. See the Credential Dumping Guide.
• Hashes over RDP: enabling RestrictedAdmin lets a password hash authenticate an RDP session. Monitor the DisableRestrictedAdmin registry value under HKLM\System\CurrentControlSet\Control\Lsa and prefer Remote Credential Guard for admin RDP. See the Pass-the-Hash and Pass-the-Ticket Guide.
• SSH credentials on Linux: lateral movement with captured SSH credentials means password-based SSH and long-lived private keys are part of the attack surface. Use certificate or short-lived key access through a bastion and inventory authorised_keys files as non-human credentials.
• Privileged domain accounts as the norm: ESET found that in most FishMedley cases the operators already had privileged access such as domain administrator credentials, and used an admin console after likely stealing sysadmin credentials. Admin accounts need phishing-resistant MFA, PAM vaulting and logon restrictions.
• Logs as a credential intelligence source: exporting Security event logs gives the operator a map of who logs on where. Treat bulk log export from a server as a high-priority alert.

Notable activity

In the 2021 case CrowdStrike's hunters were looking for unusual child processes of the VMware Horizon Tomcat service after VMware's 14 December 2021 guidance. Linux-style commands launched under Tomcat on a Windows host gave the intrusion away. That hunt remains a good model: watch what web service processes spawn.

Detection and defence

What to monitor

Phased response plan

1. Patch at disclosure speed: internet-facing systems hit by a CISA KEV entry are patched or isolated within days, not monthly. See T1190 Exploit Public-Facing Application.
2. Get logs off the host: forward Windows and Linux logs in real time to a SIEM the server admins cannot alter, so clearing a local log does not remove the evidence.
3. Protect credentials: Credential Guard, LSA protection and the LSASS ASR rule in audit then block mode; Windows LAPS; alerting on RestrictedAdmin changes.
4. Cover Linux properly: deploy EDR or auditd rules on Linux servers, monitor ld.so.preload, and move SSH to short-lived certificates through a bastion.
5. Harden admin paths: privileged access workstations, phishing-resistant MFA and PAM for domain and system admins; block RDP and SSH between servers except from admin hosts. Pilot with one admin team and keep the old firewall rules for rollback.
6. Enable EDR tamper protection: the group looks for and tries to stop EDR. See the EDR Tampering and BYOVD Response Playbook.

Decision guidance

• Rebuild or clean: with Winnti and ShadowPad on both Windows and Linux plus cleared logs, rebuild affected servers from known-good images rather than trying to clean them.
• Small organisations: reduce exposed servers, use managed EDR covering Linux, enforce MFA on remote access and forward logs to a hosted SIEM.
• High-risk targets: NGOs, religious groups and newsrooms should ask national CERTs or civil society security programmes for help; the Justice Department case shows these groups are chosen deliberately.

Metrics

• Median time to patch KEV-listed flaws on internet-facing systems.
• Percentage of Linux servers with EDR or auditd coverage forwarded to the SIEM.
• Percentage of Windows servers with Credential Guard or LSA protection.
• Number of hosts where RestrictedAdmin is enabled outside an approved list (target zero).
• Percentage of SSH access using short-lived certificates rather than static keys or passwords.

Framework mapping

Common failure patterns

• Logs only on the host: cleared event logs and shell history leave responders without a timeline.
• Linux treated as low risk: no EDR or integrity monitoring on Linux servers lets ld.so preload persistence run unseen.
• RestrictedAdmin changes go unreviewed: without monitoring, a single registry change turns stolen hashes into RDP sessions.
• Static SSH keys everywhere: captured keys and passwords give quiet movement between Linux hosts.
• Patching public servers on the monthly cycle: the 2021 case shows exploitation within days of disclosure.

Practitioner checklist

• Patch or isolate KEV-listed flaws on internet-facing systems within days.
• Forward Windows and Linux logs off-host in real time.
• Alert on Event ID 1102 and on wevtutil exports from servers.
• Enable Credential Guard, LSA protection and the LSASS ASR rule.
• Monitor DisableRestrictedAdmin and approve RestrictedAdmin use explicitly.
• Deploy EDR on Linux and watch /etc/ld.so.preload.
• Move SSH to short-lived certificates through a bastion.
• Enable EDR tamper protection everywhere.
• Rebuild, rather than clean, servers with confirmed backdoors.

Standards and references

• MITRE ATT&CK: Aquatic Panda (G0143)
• US Department of Justice: Justice Department charges 12 Chinese contract hackers and law enforcement officers
• CrowdStrike: OverWatch exposes AQUATIC PANDA in possession of Log4Shell exploit tools
• ESET: Operation FishMedley
• Microsoft: How Microsoft names threat actors
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Earth Lusca Threat Actor Profile Guide · APT41 Threat Actor Profile · APT27 Threat Actor Profile Guide · China State Cyber Operations Guide · PlugX and ShadowPad Malware Guide