Mustang Panda

Introduction

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. BlackBerry MUSTANG PANDA October 2022 Eset PlugX Korplug Mustang Panda March 2022 Anomali MUSTANG PANDA October 2019 Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 Secureworks BRONZE PRESIDENT December 2019 DOJ Affidavit Search and Seizure PlugX December 2024 EclecticIQ Mustang Panda PlugX ATTACKIQ MUSTANG PANDA TONESHELL March 2023 Crowdstrike MUSTANG PANDA June 2018 Palo Alto Networks, Unit 42 Sophos PlugX September 2022 Sophos Mustang Panda PLUGX Zscaler

Activities and Tactics

Targeted Sectors: Civil society

Country of Origin: 🇨🇳 China

First Seen: 2023

Last Activity: 2023

Incident Type: Espionage

Suspected Victims: United States, Germany

Notable Campaigns

• RedDelta Modified PlugX Infection Chain Operations (C0047): RedDelta Modified PlugX Infection Chain Operations was executed by Mustang Panda from mid-2023 through the end of 2024 against multiple entities in East and Southeast Asia. RedDelta Modified PlugX Infection Chain Operations involved phishing to deliver malicious files or links to users prompting follow-on installer downloads to load PlugX on victim machines in a persistent state.(Citation: Recorded Future RedDelta 2025)

Tactics, Techniques, and Procedures (TTPs)

• T1016 System Network Configuration Discovery
• T1608.001 Upload Malware
• T1583.006 Web Services
• T1047 Windows Management Instrumentation
• T1573.001 Symmetric Cryptography
• T1593 Search Open Websites/Domains
• T1204.001 Malicious Link
• T1046 Network Service Discovery
• T1140 Deobfuscate/Decode Files or Information
• T1049 System Network Connections Discovery
• T1059.005 Visual Basic
• T1219.001 IDE Tunneling
• T1567.002 Exfiltration to Cloud Storage
• T1053.005 Scheduled Task
• T1087.002 Domain Account
• T1598.003 Spearphishing Link
• T1678 Delay Execution
• T1564.001 Hidden Files and Directories
• T1218.005 Mshta
• T1027.007 Dynamic API Resolution
• T1585.002 Email Accounts
• T1219.002 Remote Desktop Software
• T1003 OS Credential Dumping
• T1003.006 DCSync
• T1218.004 InstallUtil
• T1586.002 Email Accounts
• T1560.001 Archive via Utility
• T1070 Indicator Removal
• T1071.001 Web Protocols
• T1018 Remote System Discovery
• T1069.002 Domain Groups
• T1001.003 Protocol or Service Impersonation
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1566.002 Spearphishing Link
• T1041 Exfiltration Over C2 Channel
• T1072 Software Deployment Tools
• T1557 Adversary-in-the-Middle
• T1505.003 Web Shell
• T1176.002 IDE Extensions
• T1588.003 Code Signing Certificates
• T1091 Replication Through Removable Media
• T1059.003 Windows Command Shell
• T1052.001 Exfiltration over USB
• T1003.001 LSASS Memory
• T1588.002 Tool
• T1588.004 Digital Certificates
• T1560.003 Archive via Custom Method
• T1070.004 File Deletion
• T1129 Shared Modules
• T1057 Process Discovery
• T1082 System Information Discovery
• T1095 Non-Application Layer Protocol
• T1203 Exploitation for Client Execution
• T1574.005 Executable Installer File Permissions Weakness
• T1608 Stage Capabilities
• T1622 Debugger Evasion
• T1566.001 Spearphishing Attachment
• T1654 Log Enumeration
• T1083 File and Directory Discovery
• T1518 Software Discovery
• T1583.001 Domains
• T1574.001 DLL
• T1546.003 Windows Management Instrumentation Event Subscription
• T1106 Native API
• T1003.003 NTDS
• T1059 Command and Scripting Interpreter
• T1553.002 Code Signing
• T1027 Obfuscated Files or Information
• T1547.001 Registry Run Keys / Startup Folder
• T1119 Automated Collection
• T1105 Ingress Tool Transfer
• T1074.001 Local Data Staging
• T1059.007 JavaScript
• T1059.001 PowerShell
• T1027.016 Junk Code Insertion
• T1070.006 Timestomp
• T1204.002 Malicious File
• T1572 Protocol Tunneling
• T1036.008 Masquerade File Type
• T1036.007 Double File Extension
• T1102 Web Service
• T1205 Traffic Signaling
• T1036.005 Match Legitimate Resource Name or Location
• T1587.001 Malware
• T1027.012 LNK Icon Smuggling

ATT&CK technique IDs (denormalized)

• T1001.003
• T1003
• T1003.001
• T1003.003
• T1003.006
• T1016
• T1018
• T1027
• T1027.007
• T1027.012
• T1027.016
• T1036.005
• T1036.007
• T1036.008
• T1041
• T1046
• T1047
• T1048.003
• T1049
• T1052.001
• T1053.005
• T1057
• T1059
• T1059.001
• T1059.003
• T1059.005
• T1059.007
• T1069.002
• T1070
• T1070.004
• T1070.006
• T1071.001
• T1072
• T1074.001
• T1082
• T1083
• T1087.002
• T1091
• T1095
• T1102
• T1105
• T1106
• T1119
• T1129
• T1140
• T1176.002
• T1203
• T1204.001
• T1204.002
• T1205
• T1218.004
• T1218.005
• T1219.001
• T1219.002
• T1505.003
• T1518
• T1546.003
• T1547.001
• T1553.002
• T1557
• T1560.001
• T1560.003
• T1564.001
• T1566.001
• T1566.002
• T1567.002
• T1572
• T1573.001
• T1574.001
• T1574.005
• T1583.001
• T1583.006
• T1585.002
• T1586.002
• T1587.001
• T1588.002
• T1588.003
• T1588.004
• T1593
• T1598.003
• T1608
• T1608.001
• T1622
• T1654
• T1678

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 2 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

MITRE ATT&CK Software

• CANONSTAGER (S1237) — malware
• STATICPLUGIN (S1238) — malware
• ShadowPad (S0596) — malware
• TONESHELL (S1239) — malware
• Cobalt Strike (S0154) — malware
• HIUPAN (S1230) — malware
• Impacket (S0357) — tool
• SplatCloak (S1234) — malware
• PAKLOG (S1233) — malware
• Wevtutil (S0645) — tool
• AdFind (S0552) — tool
• CLAIMLOADER (S1236) — malware
• Mimikatz (S0002) — tool
• PUBLOAD (S1228) — malware
• StarProxy (S1227) — malware
• CorKLOG (S1235) — malware
• RCSession (S0662) — malware
• NBTscan (S0590) — tool
• PoisonIvy (S0012) — malware
• SplatDropper (S1232) — malware
• BOOKWORM (S1226) — malware
• China Chopper (S0020) — malware
• PlugX (S0013) — malware

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [2] Cloudflare 2026 Threat Report New Threat Actors March 2026 Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026. [19] Eset PlugX Korplug Mustang Panda March 2022 Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025. [20] Anomali MUSTANG PANDA October 2019 Anomali Threat Research. (2019, October 7). China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations. Retrieved April 12, 2021. [21] Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025. [22] Broadcom Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025. [23] HorseShell Cohen, Itay. Madej, Radoslaw. Threat Intelligence Team. (2023, May 16). THE DRAGON WHO SOLD HIS CAMARO: ANALYZING CUSTOM ROUTER IMPLANT. Retrieved December 26, 2023. [24] Secureworks BRONZE PRESIDENT December 2019 Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021. [25] CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025. [26] DOJ Affidavit Search and Seizure PlugX December 2024 DOJ. (2024, December 20). Mag. No. 24-mj-1387 AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A NINTH SEARCH AND SEIZURE WARRANT- IN THE MATTER OF THE SEARCH AND SEIZURE OF COMPUTERS IN THE UNITED STATES INFECTED WITH PLUGX MALWARE . Retrieved September 9, 2025. [27] EclecticIQ Mustang Panda PlugX EclecticIQ Threat Research Team. (2023, February 2). Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware. Retrieved September 9, 2025. [28] IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 Golo Muhr, Joshua Chung. (2025, June 23). Hive0154 aka Mustang Panda shifts focus on Tibetan community to deploy Pubload backdoor. Retrieved August 4, 2025. [29] 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025. [30] Recorded Future REDDELTA July 2020 Insikt Group. (2020, July 28). CHINESE STATE-SPONSORED GROUP ‘REDDELTA’ TARGETS THE VATICAN AND CATHOLIC ORGANIZATIONS. Retrieved April 13, 2021. [31] ATTACKIQ MUSTANG PANDA TONESHELL March 2023 Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025. [32] Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024 Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025. [33] Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023 Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025. [34] Crowdstrike MUSTANG PANDA June 2018 Meyers, A. (2018, June 15). Meet CrowdStrike’s Adversary of the Month for June: MUSTANG PANDA. Retrieved April 12, 2021. [35] Microsoft Naming Conventions Frequently Updated Microsoft. (2025, September 8). How Microsoft names threat actors. Retrieved September 10, 2025. [36] Trend Micro Mustang Panda Earth Preta Toneshell February 2025 Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025. [37] 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025. [38] Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025 Patrick Whitsell. (2025, August 25). Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats. Retrieved September 9, 2025. [39] Proofpoint TA416 November 2020 Proofpoint Threat Research Team. (2020, November 23). TA416 Goes to Ground and Returns with a Golang PlugX Malware Loader. Retrieved April 13, 2021. [40] PWC UK MUSTANG PANDA RED LICH February 2021 PWC UK. (2021, February 28). Cyber Threats 2020: A Year in Retrospect. Retrieved October 15, 2025. [41] Proofpoint TA416 Europe March 2022 Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022. [42] Unit42 Bookworm Nov2015 Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025. [43] Palo Alto Networks, Unit 42 Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025. [44] Sophos PlugX September 2022 Secureworks Counter Threat Unit Research Team. (2022, April 27). BRONZE PRESIDENT Targets Russian Speakers with Updated PlugX. Retrieved September 9, 2025. [45] Sophos Mustang Panda PLUGX Secureworks Counter Threat Unit Research Team. (2022, September 8). BRONZE PRESIDENT Targets Government Officials. Retrieved September 9, 2025. [46] Zscaler Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025. [47] Trend Micro Mustang Panda Earth Preta TONESHELL June 2023 Sunny Lu, Vickie Su, Nick Dai. (2023, June 14). Behind the Scenes: Unveiling the Hidden Workings of Earth Preta. Retrieved September 10, 2025. [48] BlackBerry MUSTANG PANDA October 2022 The BlackBerry Research and Intelligence Team. (2022, October 6). Mustang Panda Abuses Legitimate Apps to Target Myanmar Based Victims. Retrieved October 14, 2025. [49] Unit42 Chinese VSCode 06 September 2024 Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.

Recent News

Latest articles from security news feeds mentioning this actor.

• Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth The Hacker News — 2026-08-14