Threat actor · all actors

Aquatic PandaG0143 state

aka Aquatic Panda

Last updated: 2026-07-03

1attributed CVEs

49ATT&CK techniques

1.2IDF score (tooling uniqueness)

0exclusive CVEs

2026years active

About this actor

[Aquatic Panda](https://attack.mitre.org/groups/G0143) is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org/groups/G0143) has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)

Source: MITRE ATT&CK

Activity timeline

2026 — 1 CVE published

Profile

CVE	Risk	CVSS	EPSS	Published	Products
`CVE-2026-20929`	5.5	7.5	0.0114	2026-01-13	see CVE

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	31 / 49	63%
`CM-6`	30 / 49	61%
`AC-2`	28 / 49	57%
`AC-3`	28 / 49	57%
`AC-6`	28 / 49	57%
`CM-2`	26 / 49	53%
`SI-3`	23 / 49	47%
`AC-5`	21 / 49	43%
`CM-7`	20 / 49	41%
`SI-7`	20 / 49	41%
`CM-5`	18 / 49	37%
`IA-2`	18 / 49	37%
`CA-7`	16 / 49	33%
`RA-5`	13 / 49	27%
`SI-10`	13 / 49	27%

Co-occurring actors

Mustang Panda 1 shared CVEs
SolarWinds Compromise 1 shared CVEs
APT38 1 shared CVEs
Tonto Team 1 shared CVEs
Ember Bear 1 shared CVEs
GOLD SOUTHFIELD 1 shared CVEs
APT28 1 shared CVEs
Sandworm Team 1 shared CVEs
Ajax Security Team 1 shared CVEs
FIN7 1 shared CVEs

Similar actors

Similar TTPs

Play 0.38
Wizard Spider 0.34
APT41 0.33
Blue Mockingbird 0.33
FIN8 0.33

Overlapping CVEs

C0027 1.00
APT12 1.00
APT28 1.00
FIN7 1.00
OilRig 1.00