Aquatic Panda (Earth Lusca): Campaigns, Malware, and TTPs

Summary

Aquatic Panda is a China-aligned APT group focused on intelligence gathering and industrial espionage. The group uses a diverse malware arsenal, including SprySOCKS, ShadowPad, and BIOPASS RAT, to target critical industries. Its operations also involve exploitation of vulnerabilities such as Log4Shell and the use of advanced rootkits to maintain stealth.

Investigation

The report outlines multiple campaigns, including Operation FishMedley and attacks involving VMware Horizon servers. It examines the technical design of the SprySOCKS backdoor, including its kernel-mode rootkit functionality and persistence features. The analysis also breaks down the group’s specific TTPs for initial access, execution, and defense evasion.

Mitigation

Organizations should validate their defenses against known Aquatic Panda tradecraft using simulation and testing platforms. Key mitigations include patching Log4j vulnerabilities such as CVE-2021-44228 and monitoring for unauthorized scheduled tasks or suspicious Windows service changes. Strong endpoint detection is also essential for identifying DLL sideloading and process injection activity.

Response

If Aquatic Panda activity is detected, responders should isolate affected systems immediately to stop lateral movement. Investigations should focus on unauthorized registry changes, especially within Print Processors or IFEO settings. Forensic analysis should prioritize memory collection from suspicious processes and auditing of scheduled tasks and Windows services.

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary intends to perform process hollowing to hide malicious code within a legitimate process container. To test if the current (albeit flawed) detection triggers, the adversary will launch powershell.exe from a specific directory. This simulates the initial stage of a Living-off-the-Land (LotL) attack where the adversary uses a standard system tool to begin their malicious activities, such as memory injection or credential harvesting. The goal is to generate a Process Creation event where the Image field contains a backslash, as defined in the detection logic.

• Regression Test Script:

    # Simulating a process launch that satisfies the (weak) detection logic
    # This mimics the start of an adversary session using a standard tool
    $targetProcess = "C:WindowsSystem32WindowsPowerShellv1.0powershell.exe"
    Write-Host "Executing: $targetProcess"
    Start-Process -FilePath $targetProcess -ArgumentList "-NoProfile -ExecutionPolicy Bypass -Command Write-Host 'Simulation Active'"

• Cleanup Commands:

    # No persistent changes made; no cleanup required for this simulation.
    Write-Host "Simulation cleanup complete."