Aquatic Panda is associated with spearphishing, web compromise, malware deployment and hands-on-keyboard intrusion activity. Attackers often use stolen credentials and living-off-the-land techniques to avoid detection. Defenders should review email security controls, patch exposed systems, and monitor for unusual scripts, service creation, process injection and suspicious authentication patterns across internal networks.
How Aquatic Panda Typically Operates
aquatic panda’s tradecraft fits a common intrusion pattern: initial access through phishing or exposed systems, then follow-on activity that blends in with normal administration. That usually means the group is more interested in persistence and access than in noisy one-shot disruption, so defenders should expect a mix of human-led actions and commodity tooling.
The Threat Actor Groups Guide is useful here because the first step is often mapping the reporting to the actor’s aliases, campaign names and broader cluster behavior. That helps teams separate a named group from the specific techniques it reuses across intrusions.
Initial Access and Execution Paths
The main entry paths associated with Aquatic Panda are spearphishing and web compromise. Phishing gives the operator a direct route into user workflows, while a compromised web asset can become a delivery point for malware or a staging point for later activity. In both cases, the aim is to land code or credentials that can be used for the next stage.
Once inside, the group is associated with malware deployment and hands-on-keyboard intrusion activity. That means the intrusion can shift from automated delivery to interactive operator behavior, which often produces more adaptive, harder-to-pattern activity than a fully scripted campaign. The Top 10 Phishing Techniques resource is a good fit for understanding the social-engineering side of the initial access chain.
Why the Group’s Tradecraft Is Hard to Spot
Aquatic Panda is also associated with stolen credentials and living-off-the-land techniques. Using legitimate accounts reduces the obviousness of the intrusion, while built-in tools and normal administrative utilities can blur malicious activity into routine operations. The defensive problem is not just the initial compromise, but the way the actor reuses trusted paths after entry.
MITRE ATT&CK Enterprise Matrix is the most useful external reference for this stage because it organizes the credential access, execution, privilege escalation and lateral movement patterns that this kind of activity usually depends on. MITRE D3FEND complements that by helping defenders translate those behaviors into countermeasures and detection logic.
Risk and Threat Considerations
The main risk is that the intrusion can look like ordinary user or administrator activity until the attacker has already expanded access. Credential theft, malicious scripting and service creation can all produce quiet but meaningful internal movement, especially when monitoring is tuned only for malware signatures rather than behavior.
Failure mechanism: The actor abuses trusted authentication, native tools and post-compromise operator control to hide in normal network and endpoint activity.
Impact: Defenders may miss lateral movement, persistence or process injection until the campaign is well established, which increases the likelihood of broader compromise and slower containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Aquatic Panda uses spearphishing to gain initial access. |
| T1059 — Command and Scripting Interpreter | Living-off-the-land and hands-on-keyboard activity often rely on script execution. | |
| T1078 — Valid Accounts | Stolen credentials are central to the group’s post-compromise access. | |
| Recommendation — Map phishing detections to T1566 and tighten mail and user reporting controls. Hunt for suspicious script execution and correlate it with interactive logins. Prioritise valid-account abuse detections and review anomalous authentication patterns. | ||
| CIS Controls v8 | CIS-9 — Email and Web Browser Protections | Spearphishing and web compromise make email and browser defenses directly relevant. |
| Recommendation — Harden email and web controls to reduce initial access opportunities. | ||
Practitioner Guidance
What to verify: Check whether email filtering, macro and attachment controls, web-filtering, endpoint telemetry and authentication logging can actually correlate the same user across phishing, web compromise and internal follow-on activity. If those signals do not line up, the attack path is likely to be under-observed.
Decision rule: If you see suspicious logins plus unusual script execution, service creation or process injection, treat the event as a potential multi-stage intrusion rather than isolated malware. Escalate quickly enough to preserve evidence from mail, endpoint and identity systems before the attacker pivots.
Practitioner takeaway: The key judgment is to look for the whole intrusion chain, not just the first alert, because this kind of activity is often most dangerous after the initial foothold has blended into normal operations.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org