Mustang Panda

{
  "id": "ATTACK:enterprise:G0129",
  "title": "Mustang Panda",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0129",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--420ac20b-f2b9-42b8-aa1a-6d4b72895ca4",
  "external_id": "G0129",
  "domain": "enterprise",
  "created": "2021-04-12T15:56:28.861Z",
  "modified": "2026-07-31T18:47:51.001Z",
  "version": "3.0",
  "aliases": [
    "Mustang Panda",
    "TA416",
    "RedDelta",
    "BRONZE PRESIDENT",
    "STATELY TAURUS",
    "FIREANT",
    "CAMARO DRAGON",
    "EARTH PRETA",
    "HIVE0154",
    "TWILL TYPHOON",
    "TANTALUM",
    "LUMINOUS MOTH",
    "UNC6384",
    "TEMP.Hex",
    "Red Lich",
    "ClumsyToad"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
      "url": "https://blog.cloudflare.com/2026-threat-report/"
    },
    {
      "source_name": "EARTH PRETA"
    },
    {
      "source_name": "FIREANT"
    },
    {
      "source_name": "ClumsyToad"
    },
    {
      "source_name": "Mustang Panda"
    },
    {
      "source_name": "UNC6384"
    },
    {
      "source_name": "TEMP.Hex"
    },
    {
      "source_name": "CAMARO DRAGON"
    },
    {
      "source_name": "HIVE0154"
    },
    {
      "source_name": "TWILL TYPHOON"
    },
    {
      "source_name": "TANTALUM"
    },
    {
      "source_name": "LUMINOUS MOTH"
    },
    {
      "source_name": "STATELY TAURUS"
    },
    {
      "source_name": "TA416"
    },
    {
      "source_name": "Red Lich"
    },
    {
      "source_name": "RedDelta"
    },
    {
      "source_name": "BRONZE PRESIDENT"
    },
    {
      "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
      "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
    },
    {
      "source_name": "Anomali MUSTANG PANDA October 2019",
      "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
    },
    {
      "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
      "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
    },
    {
      "source_name": "Broadcom",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"
    },
    {
      "source_name": "HorseShell",
      "url": "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
    },
    {
      "source_name": "Secureworks BRONZE PRESIDENT December 2019",
      "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
    },
    {
      "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
      "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
    },
    {
      "source_name": "DOJ Affidavit Search and Seizure PlugX December 2024",
      "url": "https://www.justice.gov/archives/opa/media/1384136/dl"
    },
    {
      "source_name": "EclecticIQ Mustang Panda PlugX",
      "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
    },
    {
      "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
      "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
    },
    {
      "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
      "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
    },
    {
      "source_name": "Recorded Future REDDELTA July 2020",
      "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
    },
    {
      "source_name": "ATTACKIQ MUSTANG PANDA TONESHELL March 2023",
      "url": "https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/"
    },
    {
      "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
      "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
    },
    {
      "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
      "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
    },
    {
      "source_name": "Crowdstrike MUSTANG PANDA June 2018",
      "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
    },
    {
      "source_name": "Microsoft Naming Conventions Frequently Updated",
      "url": "https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming"
    },
    {
      "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
      "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
    },
    {
      "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
      "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
    },
    {
      "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
    },
    {
      "source_name": "Proofpoint TA416 November 2020",
      "url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"
    },
    {
      "source_name": "PWC UK MUSTANG PANDA RED LICH February 2021",
      "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf"
    },
    {
      "source_name": "Proofpoint TA416 Europe March 2022",
      "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
    },
    {
      "source_name": "Unit42 Bookworm Nov2015",
      "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
    },
    {
      "source_name": "Palo Alto Networks, Unit 42",
      "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
    },
    {
      "source_name": "Sophos PlugX September 2022",
      "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
    },
    {
      "source_name": "Sophos Mustang Panda PLUGX",
      "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
    },
    {
      "source_name": "Zscaler",
      "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
    },
    {
      "source_name": "Trend Micro Mustang Panda Earth Preta TONESHELL June 2023",
      "url": "https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html"
    },
    {
      "source_name": "BlackBerry MUSTANG PANDA October 2022",
      "url": "https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims"
    },
    {
      "source_name": "Unit42 Chinese VSCode 06 September 2024",
      "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
    }
  ]
}