Mustang Panda

MITRE ATT&CK: G0129 View on attack.mitre.org

Aliases: TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad, HoneyMyte, TEMP.HEX, BASIN, Earth Preta, Stately Taurus, LuminousMoth, Polaris, Twill Typhoon, Mustang Panda, MUSTANG PANDA

First seen
2012-01-01 00:00:00
Origin
CN
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
Espionage
Related IoCs
61 (49 malicious)
Last IoC activity
2026-10-14 11:37:47
Profile updated
2026-07-07 11:48:24

Targeted industries: government-and-public-sector education-and-nonprofits technology-and-telecommunications

Targeted regions: country_code:us country_code:cn country_code:ru country_code:mn country_code:mm country_code:pk country_code:vn

Context

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.

Recent IoC activity

49 malicious indicators in Maltiverse are attributed to Mustang Panda (G0129). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample bf8e512921522e49d16c638dc8d01bd0a2803a4ef019afbfc2f0941875019ea1 2026-10-11 1
file sample ec3e491a831b4057fc0e2ebe9f43c32f1f07959b6430b323d35d6d409d2b31e4 2026-10-11 1
file sample d30e3b07d605440ac92a808e3d4eda613597e0cfdcf5a99dcc5373ad5a4d5f6d 2026-10-07 1
file sample 20368acb2989e8f58a6e93a8c8ccaf66c4ace19e29ee5eaf7d07597629d9f195 2026-10-07 1
file sample edb5d4b454b6c7d3abecd6de7099e05575b8f28bb09dfc364e45ce8c16a34fcd 2026-10-04 1
file sample b00c252a60171f33e32e64891ffe826b8a45f8816acf778838d788897213a405 2026-09-18 1
file sample 3c6ace055527877778d989f469a5a70eb5ef7700375b850f0b1b8414151105ee 2026-09-18 1
file sample 324bfb2f414be221e24aaa9fb22cb49e4d4c0904bd7c203afdff158ba63fe35b 2026-09-18 1
file sample 0e4b81e04ca77762be2afb8bd451abb2ff46d2831028cde1c5d0ec45199f01a1 2026-09-18 1
file sample 04b99518502774deb4a9d9cf6b54d43ff8f333d8ec5b4b230c0e995542bb2c61 2026-09-18 1
file sample 0032d5430f1b5fcfb6a380b4f1d226b6b919f2677340503f04df04235409b2d0 2026-09-18 1
file sample 0d13a503d86a6450f71408eb82a196718324465744bf6b8c4e0a780fd5be40c0 2026-09-18 1
file sample 10cad59ea2a566597d933b1e8ba929af0b4c7af85481eacaab708ef4ddf6e0ee 2026-09-18 1
file sample 62c2e246855d589eb1ec37a9f3bcc0b6f3ba9946532aff8a39a4dc9d3a93f42c 2026-09-18 1
file sample 5f751fb287db51f79bb6df2e330a53b6d80ef3d2af93f09bb786b62e613514db 2026-09-18 1
file sample 3489955d23e66d6f34b3ada70b4d228547dbb3ccb0f6c7282553cbbdeaf168cb 2026-09-18 1
file sample a0879dd439c7f1ed520aad0c309fe1dbf1a2fc41e2468f4174489a0ec56c47c7 2026-09-18 1
file sample baca1159acc715545a787d522950117eae5b7dc65efacfe86383f62e6b9b59d3 2026-09-18 1
file sample 8ea34b85dd4fb64f7e6591e4f1c24763fc3421caa7c0f0d8350c67b9bafa4d32 2026-09-18 1
file sample 989ede1df02e4d9620f6caf75a88a11791d156f62fdea4258e12d972df76bc05 2026-09-18 1

Detection coverage

  • 146 YARA rules
  • 854 Sigma rules

Malware & tools used

  • System Network Configuration Discovery (attack-pattern)
  • Upload Malware (attack-pattern)
  • Web Services (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Search Open Websites/Domains (attack-pattern)
  • Malicious Link (attack-pattern)
  • Network Service Discovery (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Visual Basic (attack-pattern)
  • IDE Tunneling (attack-pattern)
  • Exfiltration to Cloud Storage (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Domain Account (attack-pattern)
  • Spearphishing Link (attack-pattern)
  • Delay Execution (attack-pattern)
  • Hidden Files and Directories (attack-pattern)
  • Mshta (attack-pattern)
  • Dynamic API Resolution (attack-pattern)
  • Email Accounts (attack-pattern)
  • Remote Desktop Software (attack-pattern)
  • OS Credential Dumping (attack-pattern)
  • DCSync (attack-pattern)
  • InstallUtil (attack-pattern)

Related threat objects

Reports & references

  • cfr.org — Mustang Panda (report)
  • CrowdStrike — Meet Crowdstrikes Adversary Of The Month For June Mustang Panda (report)
  • secureworks.com — Bronze President (report)
  • darkreading.com — Chinese Apt Bronze President Spy Campaign Russian Military (report)
  • pwc.co.uk — Cyber Threats 2019 Retrospect (report)
  • Trend Micro — Earth Preta Spear Phishing Governments Worldwide (report)
  • proofpoint.com — Ta416 Goes Ground And Returns Golang Plugx Malware Loader (report)
  • proofpoint.com — Good Bad And Web Bug Ta416 Increases Operational Tempo Against European (report)
  • Palo Alto Unit 42 — Stately Taurus Targets Philippines Government Cyberespionage (report)
  • Microsoft — Rw1Afyw (report)
  • jsac.jpcert.or.jp — Jsac2023 2 Lt4 (report)
  • thecyberwire.com — Notes (report)
  • web-assets.esetstatic.com — Ceranakeeper (report)
  • ibm.com — Trapping A Mustang Panda (report)
  • research.checkpoint.com — The Dragon Who Sold His Camaro Analyzing Custom Router Implant (report)
  • blog.cloudflare.com — 2026 Threat Report (report)
  • MITRE ATT&CK — G0129 (report)
  • blog.eclecticiq.com — Mustang Panda Apt Group Uses European Commission Themed Lure To Deliver Plugx Malware (report)
  • Cisco Talos — Mustang Panda Targets Europe (report)
  • blogs.blackberry.com — Mustang Panda Abuses Legitimate Apps To Target Myanmar Based Victims (report)
  • csirt-cti.net — Stately Taurus Targets Myanmar (report)
  • go.recordedfuture.com — Cta 2020 0728 (report)
  • Palo Alto Unit 42 — Bookworm Trojan A Model Of Modular Architecture (report)
  • Palo Alto Unit 42 — Stately Taurus Abuses Vscode Southeast Asian Espionage (report)
  • Palo Alto Unit 42 — Stately Taurus Attacks Se Asian Government (report)

Attributed from

  • RedDelta Modified PlugX Infection Chain Operations (campaign)
  • RedDelta Updated PlugX Infection Chain (Deprecated) (campaign)

External references