Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.1
- FOX-IT May 2016 Mofang
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1566.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2020 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1027.013 | Encrypted/Encoded File | — |
| T1027.015 | Compression | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
Aliases
Mofang
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.