Mustang Panda
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.
- ATT&CK ID
- G0129
- Origin
- China
- Techniques
- 61
- Tools
- 23
Also tracked as TA416 · RedDelta · BRONZE PRESIDENT · STATELY TAURUS · FIREANT · CAMARO DRAGON · EARTH PRETA · HIVE0154 · TWILL TYPHOON · TANTALUM · LUMINOUS MOTH · UNC6384 · TEMP.Hex · Red Lich · ClumsyToad
Vulnerabilities it has exploited
Techniques
Reconnaissance
Search Open Websites/DomainsPhishing for Information
Resource Development
Acquire InfrastructureEstablish AccountsCompromise AccountsDevelop CapabilitiesObtain CapabilitiesStage Capabilities
Initial Access
Replication Through Removable MediaPhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterSoftware Deployment ToolsNative APIShared ModulesExploitation for Client ExecutionUser ExecutionHijack Execution Flow
Persistence
Scheduled Task/JobSoftware ExtensionsTraffic SignalingServer Software ComponentEvent Triggered ExecutionBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobEvent Triggered ExecutionBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalDeobfuscate/Decode Files or InformationTraffic SignalingSystem Binary Proxy ExecutionHide ArtifactsHijack Execution FlowDebugger EvasionDelay Execution
Defense Impairment
Credential Access
OS Credential DumpingAdversary-in-the-Middle
Discovery
System Network Configuration DiscoveryRemote System DiscoveryNetwork Service DiscoverySystem Network Connections DiscoveryProcess DiscoveryPermission Groups DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount DiscoverySoftware DiscoveryDebugger EvasionLog Enumeration
Lateral Movement
Software Deployment ToolsReplication Through Removable Media
Collection
Data StagedAutomated CollectionAdversary-in-the-MiddleArchive Collected Data
Command and Control
Data ObfuscationApplication Layer ProtocolNon-Application Layer ProtocolWeb ServiceIngress Tool TransferTraffic SignalingRemote Access ToolsProtocol TunnelingEncrypted Channel
Exfiltration
Exfiltration Over C2 ChannelExfiltration Over Alternative ProtocolExfiltration Over Physical MediumExfiltration Over Web Service
Software
AdFind · BOOKWORM · CANONSTAGER · CLAIMLOADER · China Chopper · Cobalt Strike · CorKLOG · HIUPAN · Impacket · Mimikatz · NBTscan · PAKLOG · PUBLOAD · PlugX · PoisonIvy · RCSession · STATICPLUGIN · ShadowPad · SplatCloak · SplatDropper · StarProxy · TONESHELL · Wevtutil