Aquatic Panda (Earth Lusca) Analysis: Campaigns, Malware, and TTPs

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Aquatic Panda (Earth Lusca) Analysis: Campaigns, Malware, and TTPs

Key Takeaways

  • Aquatic Panda is a China-aligned APT active since May 2020, focused on intelligence collection and industrial espionage.
  • Targets span telecommunications, technology, and government sectors, plus NGOs, think tanks, and academic institutions across Asia, Europe, and North America.
  • Major operations include FishMedley, Log4Shell exploitation, and deployment of SprySOCKS, ShadowPad, SodaMaster, BIOPASS RAT, and KTLVdoor backdoors.
  • The Picus Platform validates security controls against Aquatic Panda using threats available in the Picus Threat Library.

Aquatic Panda (aka Earth Lusca and FishMonger) is a China-aligned advanced persistent threat (APT) group first observed in May 2020.

Article Link: Aquatic Panda (Earth Lusca) Analysis: Campaigns, Malware, and TTPs