Aquatic Panda Unleashes Global Cyber Onslaught: 10 Months, 7 Targets

Aquatic Panda Unleashes Global Cyber Onslaught: 10 Months, 7 Targets

Summary

• Aquatic Panda, a China-linked espionage group that ESET tracks as FishMonger, compromised seven organizations in a 2022 campaign.
• Targets included government agencies in Taiwan and Thailand, Catholic charities, an NGO, a think tank and a Turkish organization.
• The group used malware families including ShadowPad, SodaMaster and Spyder.
• ESET linked the group to I-SOON, the Chinese contractor whose employees were charged by the U.S. in March 2025.

What ESET found

Aquatic Panda, a Chinese espionage group that ESET calls FishMonger, carried out a campaign during 2022 that ESET named Operation FishMedley. It compromised seven organizations: government agencies in Taiwan and Thailand, Catholic charities in Hungary and the U.S., a U.S. NGO, a geopolitical think tank in France and an organization in Turkey. ESET published its findings in March 2025.

The toolkit

The attackers used several implants, including ShadowPad, SodaMaster, Spyder and RPipeCommander. ShadowPad is a modular backdoor shared among several China-linked groups. An earlier version of this article described a custom malware called “Pandora” and quoted “Secure Future Labs”; neither could be verified, and both have been removed.

How they operated

Once inside a network, the attackers stole credentials, scanned for other machines and moved laterally, and likely used Dropbox to move stolen data out. ESET says the group is the operational arm of I-SOON, a Chinese contractor whose leaked internal files in 2024 exposed its hacking-for-hire work. A quote attributed to “Security Intelligence Magazine” in an earlier version could not be verified and has been removed, as has an unsupported claim that the group relied on zero-day exploits.

The U.S. response

In March 2025, the U.S. Justice Department charged several I-SOON employees and two Chinese security officials over hacking campaigns against victims worldwide. ESET’s report came out alongside those charges. A quote attributed to an “FBI Cyber Division expert John Reeves” in an earlier version could not be verified and has been removed.

How to defend against it

The targets were mostly organizations with limited security budgets, such as charities and NGOs. Basic protections help a lot here, starting with multi-factor authentication and monitoring for stolen credentials, then endpoint detection and tighter limits on which accounts can reach sensitive systems.

What it shows

Operation FishMedley shows that state-linked espionage doesn’t only hit governments and big companies. Charities are targets. So are NGOs and think tanks, because of who they work with and what they know, and they need to protect staff accounts as carefully as any government ministry would.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.