MITRE ATT&CKgroup

G0129 Mustang Panda

Published 2021-04-12 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad
Version
3.0
Created
2021-04-12

Description

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.

Related

Uses · MITRE ATT&CK (108)

  • T1678 Delay Execution technique
  • S1239 TONESHELL software (malware)
  • S1232 SplatDropper software (malware)
  • S1233 PAKLOG software (malware)
  • S1234 SplatCloak software (malware)
  • S1235 CorKLOG software (malware)
  • S1236 CLAIMLOADER software (malware)
  • S1237 CANONSTAGER software (malware)
  • S1238 STATICPLUGIN software (malware)
  • S1230 HIUPAN software (malware)
  • S1228 PUBLOAD software (malware)
  • S1226 BOOKWORM software (malware)
  • S1227 StarProxy software (malware)
  • T1176.002 IDE Extensions sub-technique
  • T1219.002 Remote Desktop Software sub-technique
  • T1219.001 IDE Tunneling sub-technique
  • T1027.016 Junk Code Insertion sub-technique
  • T1027.012 LNK Icon Smuggling sub-technique
  • T1654 Log Enumeration technique
  • T1036.008 Masquerade File Type sub-technique
  • T1027.007 Dynamic API Resolution sub-technique
  • T1622 Debugger Evasion technique
  • S0662 RCSession software (malware)
  • S0645 Wevtutil software (tool)
  • T1036.007 Double File Extension sub-technique
  • S0596 ShadowPad software (malware)
  • S0590 NBTscan software (tool)
  • T1608 Stage Capabilities technique
  • T1608.001 Upload Malware sub-technique
  • S0552 AdFind software (tool)
Show all 108 ›

Referenced by MITRE ATT&CK · attributed to (1)

  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign

References