MUSTANG PANDAThreat actor
- BASIN CASTLE
- BRONZE PRESIDENT
- camaro dragon
- clumsytoad
- Earth Preta
- fireant
- hive0154
- honeymyte
- ITG27
- luminous moth
- luminousmoth
- Polaris
- red lich
- reddelta
- Stately Taurus
- ta416
- tantalum
- temp.hex
- Twill Typhoon
- UNC6384
- unk_steadysplit
- vertigo panda
This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes. In April 2017, CrowdStrike Falcon Intelligence observed a previously unattributed actor group with a Chinese nexus targeting a U. S.-based think tank. Further analysis revealed a wider campaign with unique tactics, techniques, and procedures (TTPs).From MISP Galaxy
Last reported 5 days ago, by Sophos X-Ops23 reports
ATT&CK techniques
6 of 73 · each with the sentence it comes from- T1684Social Engineering
“"Another social engineering technique used for initial access in this campaign was the closely replicated reconstruction of Gmail's native attachment preview widget inside the email HTML body," Shen explained.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“Masquerading CI/CD Pipeline Tasks as Legitimate AI Utilities”
- T1059Command and Scripting Interpreter
“T1059.007 Command and Scripting Interpreter: JavaScriptObfuscated JavaScript running in the context of QuickFox Electron application used across multiple stages of infection.”
- T1059.003Windows Command Shell
“The cmd and powershell commands allow the operator to execute commands directly through the Windows command shell or PowerShell and collect their output.”
- T1140Deobfuscate/Decode Files or Information
“T1140”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
23 reports · the newest 20, newest first · the exact sentence from each-
BRONZE SANDCASTLE deploys modified Meterpreter shells“…rved BRONZE SANDCASTLE targeting organizations in Asia and Africa, which is typical of several China-based threat groups, including BRONZE PRESIDENT and BRONZE ATLAS.”
-
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site“Lines (Taiwan); Polaris Shipping, Dong-A Tanker, Samjoo Maritime and Korea Ferry (South Korea); Camellia Line and Tsuneishi / Kambara Kisen (Japan); Samudera (Indonesia)”
-
N0n lists Polaris Shipping (dry bulk shipping)“N0n lists Polaris Shipping (dry bulk shipping)”
-
aurora lists Infomedia A/S“Møller-Mærsk, and major Nordic media groups (Schibsted, Polaris, NRK, Amedia).”
-
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign“…CloudFront domain previously flagged by Arctic Wolf in connection with a campaign conducted by a China-affiliated threat actor known as UNC6384 targeting European diplomatic and government entities last year using an unpatched Windows shortcut vulnerability.”
-
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor“…587 that referenced “d32tpl7xt7175h.cloudfront.net”, the same CloudFront distribution previously reported by Arctic Wolf in China-nexus UNC6384 delivery activity.”
-
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall“ITG27 (Mustang Panda): Like a good neighbour, China's trying to hack India's energy sector for espionage purposes.”
-
August 2026 Threat Trend Report on APT Groups“Mustang Panda used hydropower-themed lures along with the Claimloader, ToneShell v10, and Havencode backdoors, while Earth Alux (Jewelbug) utilized XG-Web, Antino, PDF Viewer, and ClientKing for both espionage activity and cryptocurrency scams.”
-
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“BASIN CASTLE, a PRC-nexus cyber espionage group previously tracked as BASIN and TEMP.Hex, has integrated generative AI across successive phases of the attack lifecycle.”
-
QuickFox Supply Chain Attack Used to Deploy FDMTP Implant“However, there is significant technical crossover with open-source reporting that is externally attributed to Twill Typhoon.”
-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“…igned binary used here is MpCopyAccelerator.pdb (Microsoft Malware Protection Copy Accelerator Utility), which is seen to be used by Mustang Panda a lot.”
-
PlugX worm disinfection campaign feedbacks“In September 2023 Sekoia took control of an IP address used by the PlugX worm, a Mustang Panda variant spreading via flash drives.”
-
EDR killers explicados: Más allá de los drivers“…;cnica de abuso de VS Code para el acceso remoto sigiloso, documentadapreviamente en septiembre de 2024 y utilizada por el grupo APT Mustang Panda, y también fue pionera en el uso malicioso de Velociraptor.”
-
EDR killers explained: Beyond the drivers“…periment: it adapted the VS Code abuse technique for stealthy remote access, previously documented in September 2024 and used by the Mustang Panda APT group, while also pioneering the malicious use of Velociraptor.”
-
Middle East Conflict Fuels Opportunistic Cyber Attacks“Case 2: LOTUSLITE backdoor used in Iran conflict-themed lures by Mustang Panda”
-
JSAC2026 -Day 1-“The “Stately Taurus” cluster involved tools including HIUPAN, USBFect, PUBLOAD (spread via USB), and CoolClient variants.”
-
Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with TrendAI Vision One™“Key Insights on SHADOW-AETHER-015 and Earth Preta from the 2025 MITRE ATT&CK Evaluation with TrendAI Vision One™”
-
Trend Vision One™ Stacks Up Against Scattered Spider and Mustang Panda in 2025 MITRE ATT&CK® Evaluations“Trend Vision One™ Stacks Up Against Scattered Spider and Mustang Panda in 2025 MITRE ATT&CK® Evaluations”
-
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns“In addition, we are aware that similar activity has been documented by Unit 42 in their research on Stately Taurus.”
-
Shedding light on the dark web“In early November 2020, a user nicknamed The Polaris initiated a dispute against ExpertData in a separate thread.”
Indicators in its reports
named in the reports above- 82ed942a52cdcf12…ba37619661a3in 2 reports
- 54547180a99474b0…8f3eea78b531in 2 reports
- 75f85caea52fe5a1…bd3161690addin 2 reports
- 002573d80091f7f8…2b85fa915f19in 2 reports
- 1e7567c0d525ad03…f40541994411in 2 reports
- 65c2388b0afb1d1f…d8d6cd8b5645in 2 reports
- a9f37104d2d89051…bff44d147e67in 2 reports
- 083f604377d74c43…e34ad7daceeain 2 reports
- 570161a420992280…800296b72d1cin 2 reports
- bbe0e14bc7ece8a7…0476cfcef110in 2 reports
- 31ce76931ca09d39…3bc72e6d647ein 2 reports
- b9820bf443c37557…e3a569a1b9e8in 2 reports
- 34270b07538b7357…8f234b602f93in 2 reports
- 09735640d6634b03…bc80f932126cin 2 reports
- 85bc0a4f67522d6a…5a2945ec5028in 2 reports
- 711c95fead2215e9…0d71ad5c5aa5in 2 reports
- bc65ed919988c8e4…45456601700ain 2 reports
- 148c0cde4f2ef807…0f4c519f47efin 2 reports
- 468121e7d6952799…937c4c5f92edin 2 reports
- c881f43c7fe94a6f…32fe56d8dd9cin 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.