Hacker groupG0129
Mustang Panda
Also tracked as TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.
- Known attack methods
- 85
- Origin
- China
- Motive
- Espionage
- First seen
- 2012
- Last seen
- 2024-12
- Source
- MITRE ATT&CK
How they break in
Techniques MITRE has documented this group using, mapped onto the ATT&CK matrix. Each one is a behaviour you can look for in your own logs, and a control you can test.
Used by this groupNot documented for this groupIn brackets: sub-techniques this group uses, of those that exist.
Reconnaissance
12 techniques · 2 used
Resource Development
9 techniques · 6 used
Initial Access
11 techniques · 1 used
Execution
20 techniques · 8 used
Persistence
22 techniques · 3 used
Privilege Escalation
13 techniques · 1 used
Stealth
30 techniques · 10 used
Defense Impairment
18 techniques · 1 used
Credential Access
17 techniques · 2 used
Discovery
34 techniques · 11 used
Lateral Movement
9 techniques · 1 used
Collection
17 techniques · 3 used
Command and Control
18 techniques · 8 used
Exfiltration
9 techniques · 4 used
Impact
15 techniques
Reconnaissance2
Resource development10
Initial access2
Execution13
- T1047Windows Management Instrumentation
- T1053.005Scheduled Task
- T1059Command and Scripting Interpreter
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.005Visual Basic
- T1059.007JavaScript
- T1072Software Deployment Tools
- T1106Native API
- T1129Shared Modules
- T1203Exploitation for Client Execution
- T1204.001Malicious Link
- T1204.002Malicious File
Privilege escalation1
Stealth19
- T1027Obfuscated Files or Information
- T1027.007Dynamic API Resolution
- T1027.012LNK Icon Smuggling
- T1027.016Junk Code Insertion
- T1036.005Match Legitimate Resource Name or Location
- T1036.007Double File Extension
- T1036.008Masquerade File Type
- T1070Indicator Removal
- T1070.004File Deletion
- T1070.006Timestomp
- T1140Deobfuscate/Decode Files or Information
- T1205Traffic Signaling
- T1218.004InstallUtil
- T1218.005Mshta
- T1564.001Hidden Files and Directories
- T1574.001DLL
- T1574.005Executable Installer File Permissions Weakness
- T1622Debugger Evasion
- T1678Delay Execution
Defense impairment1
Credential access5
Discovery11
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1046Network Service Discovery
- T1049System Network Connections Discovery
- T1057Process Discovery
- T1069.002Domain Groups
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1087.002Domain Account
- T1518Software Discovery
- T1654Log Enumeration
Lateral movement1
Collection4
Command and control9
Malware
Families MITRE records this group deploying. Detection names for these are a reasonable place to start.
BOOKWORMCANONSTAGERCLAIMLOADERChina ChopperCobalt StrikeCorKLOGHIUPANPAKLOGPUBLOADPlugXPoisonIvyRCSessionSTATICPLUGINShadowPadSplatCloakSplatDropperStarProxyTONESHELL
Tools
Legitimate or dual-use software the group is documented using. Most of it is software your own administrators use too, which is the point.
AdFindImpacketMimikatzNBTscanWevtutil
Campaigns
RedDelta Modified PlugX Infection Chain Operations