自动化接入 · API / MCP EN

组织档案 · G0129

Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.

ATT&CK G0129 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2021

当前只显示 2021 年的引用；分面页不参与索引，canonical 归组织档案。

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. 12345678910111213

  1. BlackBerry MUSTANG PANDA October 2022
  2. Eset PlugX Korplug Mustang Panda March 2022
  3. Anomali MUSTANG PANDA October 2019
  4. Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022
  5. Secureworks BRONZE PRESIDENT December 2019
  6. DOJ Affidavit Search and Seizure PlugX December 2024
  7. EclecticIQ Mustang Panda PlugX
  8. ATTACKIQ MUSTANG PANDA TONESHELL March 2023
  9. Crowdstrike MUSTANG PANDA June 2018
  10. Palo Alto Networks, Unit 42
  11. Sophos PlugX September 2022
  12. Sophos Mustang Panda PLUGX
  13. Zscaler

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
uses_techniquetech_t10162021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1608.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1573.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t15932021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10462021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11402021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10492021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1219.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1567.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1053.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1087.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1598.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t16782021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1564.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0072021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1219.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0062021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0042021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1586.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10702021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10182021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1069.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1001.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1048.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10412021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10722021 → …100src_mitre_attck_enterprise
uses_techniquetech_t15572021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1505.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1176.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10912021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1052.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0042021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0042021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11292021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10572021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10952021 → …100src_mitre_attck_enterprise
uses_techniquetech_t12032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1574.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t16082021 → …100src_mitre_attck_enterprise
uses_techniquetech_t16222021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t16542021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10832021 → …100src_mitre_attck_enterprise
uses_techniquetech_t15182021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1574.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1546.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11062021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0032021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10592021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t10272021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11192021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1074.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0072021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0162021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0062021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t15722021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0082021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0072021 → …100src_mitre_attck_enterprise
uses_techniquetech_t11022021 → …100src_mitre_attck_enterprise
uses_techniquetech_t12052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012021 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0122021 → …100src_mitre_attck_enterprise

技术使用

ATT&CK技术platforms
T1001.003Protocol or Service Impersonation—
T1003OS Credential Dumping—
T1003.001LSASS Memory—
T1003.003NTDS—
T1003.006DCSync—
T1016System Network Configuration Discovery—
T1018Remote System Discovery—
T1027Obfuscated Files or Information—
T1027.007Dynamic API Resolution—
T1027.012LNK Icon Smuggling—
T1027.016Junk Code Insertion—
T1036.005Match Legitimate Resource Name or Location—
T1036.007Double File Extension—
T1036.008Masquerade File Type—
T1041Exfiltration Over C2 Channel—
T1046Network Service Discovery—
T1047Windows Management Instrumentation—
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol—
T1049System Network Connections Discovery—
T1052.001Exfiltration over USB—
T1053.005Scheduled Task—
T1057Process Discovery—
T1059Command and Scripting Interpreter—
T1059.001PowerShell—
T1059.003Windows Command Shell—
T1059.005Visual Basic—
T1059.007JavaScript—
T1069.002Domain Groups—
T1070Indicator Removal—
T1070.004File Deletion—
T1070.006Timestomp—
T1071.001Web Protocols—
T1072Software Deployment Tools—
T1074.001Local Data Staging—
T1082System Information Discovery—
T1083File and Directory Discovery—
T1087.002Domain Account—
T1091Replication Through Removable Media—
T1095Non-Application Layer Protocol—
T1102Web Service—
T1105Ingress Tool Transfer—
T1106Native API—
T1119Automated Collection—
T1129Shared Modules—
T1140Deobfuscate/Decode Files or Information—
T1176.002IDE Extensions—
T1203Exploitation for Client Execution—
T1204.001Malicious Link—
T1204.002Malicious File—
T1205Traffic Signaling—
T1218.004InstallUtil—
T1218.005Mshta—
T1219.001IDE Tunneling—
T1219.002Remote Desktop Software—
T1505.003Web Shell—
T1518Software Discovery—
T1546.003Windows Management Instrumentation Event Subscription—
T1547.001Registry Run Keys / Startup Folder—
T1553.002Code Signing—
T1557Adversary-in-the-Middle—
T1560.001Archive via Utility—
T1560.003Archive via Custom Method—
T1564.001Hidden Files and Directories—
T1566.001Spearphishing Attachment—
T1566.002Spearphishing Link—
T1567.002Exfiltration to Cloud Storage—
T1572Protocol Tunneling—
T1573.001Symmetric Cryptography—
T1574.001DLL—
T1574.005Executable Installer File Permissions Weakness—
T1583.001Domains—
T1583.006Web Services—
T1585.002Email Accounts—
T1586.002Email Accounts—
T1587.001Malware—
T1588.002Tool—
T1588.003Code Signing Certificates—
T1588.004Digital Certificates—
T1593Search Open Websites/Domains—
T1598.003Spearphishing Link—
T1608Stage Capabilities—
T1608.001Upload Malware—
T1622Debugger Evasion—
T1654Log Enumeration—
T1678Delay Execution—

别名

BRONZE PRESIDENT · CAMARO DRAGON · ClumsyToad · EARTH PRETA · FIREANT · HIVE0154 · LUMINOUS MOTH · Mustang Panda · RedDelta · Red Lich · STATELY TAURUS · TA416 · TANTALUM · TEMP.Hex · TWILL TYPHOON · UNC6384

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错