Threat intelligence / Group

Mustang Panda

[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. [Mustang Panda](https://attack.mitre.org/groups/G0129) has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. (Citation: BlackBerry MUSTANG PANDA October 2022)(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: DOJ Affidavit Search and Seizure PlugX December 2024)(Citation: EclecticIQ Mustang Panda PlugX)(Citation: ATTACKIQ MUSTANG PANDA TONESHELL March 2023)(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Palo Alto Networks, Unit 42)(Citation: Sophos PlugX September 2022)(Citation: Sophos Mustang Panda PLUGX)(Citation: Zscaler)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

109 recorded

Relationships

attributed-to

from RedDelta Modified PlugX Infection Chain Operations

Campaign

uses

to AdFind

Tool

uses

to Adversary-in-the-Middle

Technique

uses

to Archive via Custom Method

Technique

uses

to Archive via Utility

Technique

uses

to Automated Collection

Technique

uses

to BOOKWORM

Malware

uses

to CANONSTAGER

Malware

uses

to China Chopper

Malware

uses

to CLAIMLOADER

Malware

uses

to Cobalt Strike

Malware

uses

to Code Signing

Technique

uses

to Code Signing Certificates

Technique

uses

to Command and Scripting Interpreter

Technique

uses

to CorKLOG

Malware

uses

to DCSync

Technique

uses

to Debugger Evasion

Technique

uses

to Delay Execution

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Digital Certificates

Technique

uses

to DLL

Technique

uses

to Domain Account

Technique

uses

to Domain Groups

Technique

uses

to Domains

Technique

uses

to Double File Extension

Technique

uses

to Dynamic API Resolution

Technique

uses

to Email Accounts

Technique

uses

to Email Accounts

Technique

uses

to Executable Installer File Permissions Weakness

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Exfiltration over USB

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to Exploitation for Client Execution

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Hidden Files and Directories

Technique

uses

to HIUPAN

Malware

uses

to IDE Extensions

Technique

uses

to IDE Tunneling

Technique

uses

to Impacket

Tool

uses

to Indicator Removal

Technique

uses

to Ingress Tool Transfer

Technique

uses

to InstallUtil

Technique

uses

to JavaScript

Technique

uses

to Junk Code Insertion

Technique

uses

to LNK Icon Smuggling

Technique

uses

to Local Data Staging

Technique

uses

to Log Enumeration

Technique

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Malware

Technique

uses

to Masquerade File Type

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mimikatz

Tool

uses

to Mshta

Technique

uses

to Native API

Technique

uses

to NBTscan

Tool

uses

to Network Service Discovery

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to NTDS

Technique

uses

to Obfuscated Files or Information

Technique

uses

to OS Credential Dumping

Technique

uses

to PAKLOG

Malware

uses

to PlugX

Malware

uses

to PoisonIvy

Malware

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to Protocol or Service Impersonation

Technique

uses

to Protocol Tunneling

Technique

uses

to PUBLOAD

Malware

uses

to RCSession

Malware

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Desktop Software

Technique

uses

to Remote System Discovery

Technique

uses

to Replication Through Removable Media

Technique

uses

to Scheduled Task

Technique

uses

to Search Open Websites/Domains

Technique

uses

to ShadowPad

Malware

uses

to Shared Modules

Technique

uses

to Software Deployment Tools

Technique

uses

to Software Discovery

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Spearphishing Link

Technique

uses

to SplatCloak

Malware

uses

to SplatDropper

Malware

uses

to Stage Capabilities

Technique

uses

to StarProxy

Malware

uses

to STATICPLUGIN

Malware

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to Timestomp

Technique

uses

to TONESHELL

Malware

uses

to Tool

Technique

uses

to Traffic Signaling

Technique

uses

to Upload Malware

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Web Service

Technique

uses

to Web Services

Technique

uses

to Web Shell

Technique

uses

to Wevtutil

Tool

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

49 external

References

mitre-attack

G0129

open

Cloudflare 2026 Threat Report New Threat Actors March 2026

https://blog.cloudflare.com/2026-threat-report/

open

EARTH PRETA

—

FIREANT

—

ClumsyToad

—

Mustang Panda

—

UNC6384

—

TEMP.Hex

—

CAMARO DRAGON

—

HIVE0154

—

TWILL TYPHOON

—

TANTALUM

—

LUMINOUS MOTH

—

STATELY TAURUS

—

TA416

—

Red Lich

—

RedDelta

—

BRONZE PRESIDENT

—

Eset PlugX Korplug Mustang Panda March 2022

https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/

open

Anomali MUSTANG PANDA October 2019

https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations

open

Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022

https://blog.talosintelligence.com/mustang-panda-targets-europe/

open

Broadcom

https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia

open

HorseShell

https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/

open

Secureworks BRONZE PRESIDENT December 2019

https://www.secureworks.com/research/bronze-president-targets-ngos

open

CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/

open

DOJ Affidavit Search and Seizure PlugX December 2024

https://www.justice.gov/archives/opa/media/1384136/dl

open

EclecticIQ Mustang Panda PlugX

https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware

open

IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025

https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor

open

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan

open

Recorded Future REDDELTA July 2020

https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf

open

ATTACKIQ MUSTANG PANDA TONESHELL March 2023

https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/

open

Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html

open

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/

open

Crowdstrike MUSTANG PANDA June 2018

https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/

open

Microsoft Naming Conventions Frequently Updated

https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming

open

Trend Micro Mustang Panda Earth Preta Toneshell February 2025

https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html

open

2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html

open

Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025

https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats

open

Proofpoint TA416 November 2020

https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader

open

PWC UK MUSTANG PANDA RED LICH February 2021

https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf

open

Proofpoint TA416 Europe March 2022

https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european

open

Unit42 Bookworm Nov2015

https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/

open

Palo Alto Networks, Unit 42

https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/

open

Sophos PlugX September 2022

https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx

open

Sophos Mustang Panda PLUGX

https://www.secureworks.com/blog/bronze-president-targets-government-officials

open

Zscaler

https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1

open

Trend Micro Mustang Panda Earth Preta TONESHELL June 2023

https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html

open

BlackBerry MUSTANG PANDA October 2022

https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims

open

Unit42 Chinese VSCode 06 September 2024

https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/

open