Automation · API / MCP 中文

Group profile · G0129

Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.

ATT&CK G0129 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2021

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. 12345678910111213

  1. BlackBerry MUSTANG PANDA October 2022
  2. Eset PlugX Korplug Mustang Panda March 2022
  3. Anomali MUSTANG PANDA October 2019
  4. Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022
  5. Secureworks BRONZE PRESIDENT December 2019
  6. DOJ Affidavit Search and Seizure PlugX December 2024
  7. EclecticIQ Mustang Panda PlugX
  8. ATTACKIQ MUSTANG PANDA TONESHELL March 2023
  9. Crowdstrike MUSTANG PANDA June 2018
  10. Palo Alto Networks, Unit 42
  11. Sophos PlugX September 2022
  12. Sophos Mustang Panda PLUGX
  13. Zscaler

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
also_known_asMustang Panda— → …100src_mitre_attck_enterprise
also_known_asTA416— → …100src_mitre_attck_enterprise
also_known_asRedDelta— → …100src_mitre_attck_enterprise
also_known_asBRONZE PRESIDENT— → …100src_mitre_attck_enterprise
also_known_asSTATELY TAURUS— → …100src_mitre_attck_enterprise
also_known_asFIREANT— → …100src_mitre_attck_enterprise
also_known_asCAMARO DRAGON— → …100src_mitre_attck_enterprise
also_known_asEARTH PRETA— → …100src_mitre_attck_enterprise
also_known_asHIVE0154— → …100src_mitre_attck_enterprise
also_known_asTWILL TYPHOON— → …100src_mitre_attck_enterprise
also_known_asTANTALUM— → …100src_mitre_attck_enterprise
also_known_asLUMINOUS MOTH— → …100src_mitre_attck_enterprise
also_known_asUNC6384— → …100src_mitre_attck_enterprise
also_known_asTEMP.Hex— → …100src_mitre_attck_enterprise
also_known_asRed Lich— → …100src_mitre_attck_enterprise
also_known_asClumsyToad— → …100src_mitre_attck_enterprise
uses_techniquetech_t10162021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1608.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1573.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t15932021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10462021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11402021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10492021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1219.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1567.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1053.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1087.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1598.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t16782021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1564.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0072021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1219.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0062021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0042021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1586.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10702021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10182021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1069.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1001.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1048.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10412021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10722021 → …100src_mitre_attck_enterprise
uses_techniquetech_t15572021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1505.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1176.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10912021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1052.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0042021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0042021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11292021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10572021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10952021 → …100src_mitre_attck_enterprise
uses_techniquetech_t12032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1574.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t16082021 → …100src_mitre_attck_enterprise
uses_techniquetech_t16222021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t16542021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10832021 → …100src_mitre_attck_enterprise
uses_techniquetech_t15182021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1574.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1546.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11062021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10592021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10272021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11192021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1074.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0072021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0162021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0062021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t15722021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0082021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0072021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t12052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0122021 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1001.003Protocol or Service Impersonation—
T1003OS Credential Dumping—
T1003.001LSASS Memory—
T1003.003NTDS—
T1003.006DCSync—
T1016System Network Configuration Discovery—
T1018Remote System Discovery—
T1027Obfuscated Files or Information—
T1027.007Dynamic API Resolution—
T1027.012LNK Icon Smuggling—
T1027.016Junk Code Insertion—
T1036.005Match Legitimate Resource Name or Location—
T1036.007Double File Extension—
T1036.008Masquerade File Type—
T1041Exfiltration Over C2 Channel—
T1046Network Service Discovery—
T1047Windows Management Instrumentation—
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol—
T1049System Network Connections Discovery—
T1052.001Exfiltration over USB—
T1053.005Scheduled Task—
T1057Process Discovery—
T1059Command and Scripting Interpreter—
T1059.001PowerShell—
T1059.003Windows Command Shell—
T1059.005Visual Basic—
T1059.007JavaScript—
T1069.002Domain Groups—
T1070Indicator Removal—
T1070.004File Deletion—
T1070.006Timestomp—
T1071.001Web Protocols—
T1072Software Deployment Tools—
T1074.001Local Data Staging—
T1082System Information Discovery—
T1083File and Directory Discovery—
T1087.002Domain Account—
T1091Replication Through Removable Media—
T1095Non-Application Layer Protocol—
T1102Web Service—
T1105Ingress Tool Transfer—
T1106Native API—
T1119Automated Collection—
T1129Shared Modules—
T1140Deobfuscate/Decode Files or Information—
T1176.002IDE Extensions—
T1203Exploitation for Client Execution—
T1204.001Malicious Link—
T1204.002Malicious File—
T1205Traffic Signaling—
T1218.004InstallUtil—
T1218.005Mshta—
T1219.001IDE Tunneling—
T1219.002Remote Desktop Software—
T1505.003Web Shell—
T1518Software Discovery—
T1546.003Windows Management Instrumentation Event Subscription—
T1547.001Registry Run Keys / Startup Folder—
T1553.002Code Signing—
T1557Adversary-in-the-Middle—
T1560.001Archive via Utility—
T1560.003Archive via Custom Method—
T1564.001Hidden Files and Directories—
T1566.001Spearphishing Attachment—
T1566.002Spearphishing Link—
T1567.002Exfiltration to Cloud Storage—
T1572Protocol Tunneling—
T1573.001Symmetric Cryptography—
T1574.001DLL—
T1574.005Executable Installer File Permissions Weakness—
T1583.001Domains—
T1583.006Web Services—
T1585.002Email Accounts—
T1586.002Email Accounts—
T1587.001Malware—
T1588.002Tool—
T1588.003Code Signing Certificates—
T1588.004Digital Certificates—
T1593Search Open Websites/Domains—
T1598.003Spearphishing Link—
T1608Stage Capabilities—
T1608.001Upload Malware—
T1622Debugger Evasion—
T1654Log Enumeration—
T1678Delay Execution—

Aliases

BRONZE PRESIDENT · CAMARO DRAGON · ClumsyToad · EARTH PRETA · FIREANT · HIVE0154 · LUMINOUS MOTH · Mustang Panda · RedDelta · Red Lich · STATELY TAURUS · TA416 · TANTALUM · TEMP.Hex · TWILL TYPHOON · UNC6384

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections