- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2012–2026
- Status
- Active
- ATT&CK
- G0129 · 85 techniques
- Sources
- 13 sources carry it
- Identifier
- GINC-APT-0018 · mustang-panda
ChinaWhat it is
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Vertigo Panda
- IBM X-Force
- ITG27
- Mandiant
- UNC6384, TEMP.Hex
- Microsoft
- Twill Typhoon, DEV-0117
- MITRE ATT&CK
- G0129
- Proofpoint
- TA416
- PwC
- Red Lich
- Secureworks
- BRONZE PRESIDENT
- Operations
- Operation “Dianxun”, Operation “SmugX”
- Other names
- Camaro Dragon, LuminousMoth, PKPLUG, RedDelta, SmugX, BASIN, BASIN CASTLE, Bronze Fillmore, ClumsyToad, EARTH PRETA, FIREANT, HIVE0154, HoneyMyte, LUMINOUS MOTH, Mustang Panda (CrowdStrike), Mustang Panda, Bronze President, Polaris, STATELY TAURUS, TANTALUM, Twill Typhoon (Microsoft), UNK_SteadySplit
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Australia, Bangladesh, Belgium, Bulgaria, Cambodia, China, Cyprus, Czech, Ethiopia, France, Germany, Greece, Hong Kong, Hungary, India, Indonesia, Italy, Japan, Malaysia, Mongolia, Myanmar, Nepal, Pakistan, Philippines, Russia, Singapore, Slovakia, South Africa, South Korea, South Sudan, Spain, Sweden, Taiwan, Thailand, Tibet, Ukraine, United Kingdom, United States, Vietnam
- Sectors
- Aviation, Civil society, Education, Government, Healthcare, Law enforcement, NGOs, Telecommunications, Think Tanks
Tools
The tools and malware families the sources tie to it.
- AdFind
- BOOKWORM
- CANONSTAGER
- CLAIMLOADER
- China Chopper
- Cobalt Strike
- CorKLOG
- HIUPAN
- Impacket
- Mimikatz
- NBTscan
- PAKLOG
- PUBLOAD
- PlugX
- PoisonIvy
- RCSession
- STATICPLUGIN
- ShadowPad
- SplatCloak
- SplatDropper
- StarProxy
- TONESHELL
- Wevtutil
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de