Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:G0129",
    "title": "Mustang Panda",
    "type": "IntrusionSet",
    "source_url": "https://attack.mitre.org/groups/G0129",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "intrusion-set--420ac20b-f2b9-42b8-aa1a-6d4b72895ca4",
    "external_id": "G0129",
    "domain": "enterprise",
    "created": "2021-04-12T15:56:28.861Z",
    "modified": "2026-07-31T18:47:51.001Z",
    "version": "3.0",
    "aliases": [
      "Mustang Panda",
      "TA416",
      "RedDelta",
      "BRONZE PRESIDENT",
      "STATELY TAURUS",
      "FIREANT",
      "CAMARO DRAGON",
      "EARTH PRETA",
      "HIVE0154",
      "TWILL TYPHOON",
      "TANTALUM",
      "LUMINOUS MOTH",
      "UNC6384",
      "TEMP.Hex",
      "Red Lich",
      "ClumsyToad"
    ],
    "tactics": [

    ],
    "source_references": [
      {
        "source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
        "url": "https://blog.cloudflare.com/2026-threat-report/"
      },
      {
        "source_name": "EARTH PRETA"
      },
      {
        "source_name": "FIREANT"
      },
      {
        "source_name": "ClumsyToad"
      },
      {
        "source_name": "Mustang Panda"
      },
      {
        "source_name": "UNC6384"
      },
      {
        "source_name": "TEMP.Hex"
      },
      {
        "source_name": "CAMARO DRAGON"
      },
      {
        "source_name": "HIVE0154"
      },
      {
        "source_name": "TWILL TYPHOON"
      },
      {
        "source_name": "TANTALUM"
      },
      {
        "source_name": "LUMINOUS MOTH"
      },
      {
        "source_name": "STATELY TAURUS"
      },
      {
        "source_name": "TA416"
      },
      {
        "source_name": "Red Lich"
      },
      {
        "source_name": "RedDelta"
      },
      {
        "source_name": "BRONZE PRESIDENT"
      },
      {
        "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
        "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
      },
      {
        "source_name": "Anomali MUSTANG PANDA October 2019",
        "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
      },
      {
        "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
        "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
      },
      {
        "source_name": "Broadcom",
        "url": "https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"
      },
      {
        "source_name": "HorseShell",
        "url": "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
      },
      {
        "source_name": "Secureworks BRONZE PRESIDENT December 2019",
        "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
      },
      {
        "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
        "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
      },
      {
        "source_name": "DOJ Affidavit Search and Seizure PlugX December 2024",
        "url": "https://www.justice.gov/archives/opa/media/1384136/dl"
      },
      {
        "source_name": "EclecticIQ Mustang Panda PlugX",
        "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
      },
      {
        "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
        "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
      },
      {
        "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
        "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
      },
      {
        "source_name": "Recorded Future REDDELTA July 2020",
        "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
      },
      {
        "source_name": "ATTACKIQ MUSTANG PANDA TONESHELL March 2023",
        "url": "https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/"
      },
      {
        "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
        "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
      },
      {
        "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
        "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
      },
      {
        "source_name": "Crowdstrike MUSTANG PANDA June 2018",
        "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
      },
      {
        "source_name": "Microsoft Naming Conventions Frequently Updated",
        "url": "https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming"
      },
      {
        "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
        "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
      },
      {
        "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
        "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
      },
      {
        "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
      },
      {
        "source_name": "Proofpoint TA416 November 2020",
        "url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"
      },
      {
        "source_name": "PWC UK MUSTANG PANDA RED LICH February 2021",
        "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf"
      },
      {
        "source_name": "Proofpoint TA416 Europe March 2022",
        "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
      },
      {
        "source_name": "Unit42 Bookworm Nov2015",
        "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
      },
      {
        "source_name": "Palo Alto Networks, Unit 42",
        "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
      },
      {
        "source_name": "Sophos PlugX September 2022",
        "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
      },
      {
        "source_name": "Sophos Mustang Panda PLUGX",
        "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
      },
      {
        "source_name": "Zscaler",
        "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
      },
      {
        "source_name": "Trend Micro Mustang Panda Earth Preta TONESHELL June 2023",
        "url": "https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html"
      },
      {
        "source_name": "BlackBerry MUSTANG PANDA October 2022",
        "url": "https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims"
      },
      {
        "source_name": "Unit42 Chinese VSCode 06 September 2024",
        "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--036e996f-5767-4306-9dfa-7c22e797aecc",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1016",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--036e996f-5767-4306-9dfa-7c22e797aecc",
      "modified": "2026-07-31T18:47:51.631Z",
      "references": [
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1557ba2a-9529-4546-b0b8-441b6ac6c4c6",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1237",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1557ba2a-9529-4546-b0b8-441b6ac6c4c6",
      "modified": "2026-07-31T18:47:51.647Z",
      "references": [
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--165b8698-8d09-4602-9385-c5002c3eb46e",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1608.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--165b8698-8d09-4602-9385-c5002c3eb46e",
      "modified": "2026-07-31T18:47:51.666Z",
      "references": [
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1909eab3-597b-4f10-9652-d8a563fb57e1",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1583.006",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1909eab3-597b-4f10-9652-d8a563fb57e1",
      "modified": "2026-07-31T18:47:51.676Z",
      "references": [
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1969fef1-3e75-4228-b034-b6436f207c01",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1047",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1969fef1-3e75-4228-b034-b6436f207c01",
      "modified": "2026-07-31T18:47:51.691Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1ca66056-792e-4e19-8742-a782d87806e4",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1573.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1ca66056-792e-4e19-8742-a782d87806e4",
      "modified": "2026-09-02T20:07:46.147Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20e34dcc-cf1f-4657-890b-8ee7658ba12a",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1593",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20e34dcc-cf1f-4657-890b-8ee7658ba12a",
      "modified": "2026-07-31T18:47:51.720Z",
      "references": [
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--21428cb8-edf9-4729-95bb-5416937f122b",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1238",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--21428cb8-edf9-4729-95bb-5416937f122b",
      "modified": "2026-07-31T18:47:51.745Z",
      "references": [
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--218a923b-2909-4186-8cf7-8fbfed6f2aaf",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1204.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--218a923b-2909-4186-8cf7-8fbfed6f2aaf",
      "modified": "2026-07-31T18:47:51.766Z",
      "references": [
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        },
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        },
        {
          "source_name": "McAfee Dianxun March 2021",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2773ed2b-4ec2-4528-8a3c-ca878fbbfa21",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1046",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2773ed2b-4ec2-4528-8a3c-ca878fbbfa21",
      "modified": "2026-07-31T18:47:51.784Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--28f9439e-f458-4c48-8f5c-2e58852fdf79",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--28f9439e-f458-4c48-8f5c-2e58852fdf79",
      "modified": "2026-07-31T18:47:51.801Z",
      "references": [
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        },
        {
          "source_name": "Sophos Mustang Panda PLUGX",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2cc2c5ca-7c7a-4ab7-9cb3-76bdd14324b8",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1049",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2cc2c5ca-7c7a-4ab7-9cb3-76bdd14324b8",
      "modified": "2026-07-31T18:47:51.819Z",
      "references": [
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2d352952-c19d-4e1d-8d23-1001f69b74d0",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2d352952-c19d-4e1d-8d23-1001f69b74d0",
      "modified": "2026-07-31T18:47:51.840Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2f405cde-1625-423a-a4d4-cde1387e6481",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1219.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2f405cde-1625-423a-a4d4-cde1387e6481",
      "modified": "2026-07-31T18:47:51.854Z",
      "references": [
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2f8d04f9-04af-4bf9-9841-2d7728abdf84",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1567.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2f8d04f9-04af-4bf9-9841-2d7728abdf84",
      "modified": "2026-07-31T18:47:51.871Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--300fe039-5361-41e2-857f-5a8a311824d9",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1053.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--300fe039-5361-41e2-857f-5a8a311824d9",
      "modified": "2026-07-31T18:47:51.887Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "McAfee Dianxun March 2021",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--313102fa-9545-46c9-84cd-74c6e29a5ad3",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1087.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--313102fa-9545-46c9-84cd-74c6e29a5ad3",
      "modified": "2026-07-31T18:47:51.902Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--33a2131c-2b3a-459f-8d66-e52a5e4f3d40",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0596",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--33a2131c-2b3a-459f-8d66-e52a5e4f3d40",
      "modified": "2026-07-31T18:47:51.923Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--33ee917f-8624-4108-91fb-a87d576ac634",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1598.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--33ee917f-8624-4108-91fb-a87d576ac634",
      "modified": "2026-07-31T18:47:51.935Z",
      "references": [
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3426458d-9dcc-48b3-8bfc-24cf82377656",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1678",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3426458d-9dcc-48b3-8bfc-24cf82377656",
      "modified": "2026-07-31T18:47:51.950Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--34b96e5d-1b2a-4ca5-89b5-7de398966bea",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1564.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--34b96e5d-1b2a-4ca5-89b5-7de398966bea",
      "modified": "2026-07-31T18:47:51.965Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--36838da3-5543-4998-b125-0a50d31d288e",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1218.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--36838da3-5543-4998-b125-0a50d31d288e",
      "modified": "2026-07-31T18:47:51.984Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3952c58b-f181-4051-a4e0-ad351e625ba4",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.007",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3952c58b-f181-4051-a4e0-ad351e625ba4",
      "modified": "2026-07-31T18:47:52.016Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a3956aa-6756-4682-aa1b-c5199c0f3540",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1585.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a3956aa-6756-4682-aa1b-c5199c0f3540",
      "modified": "2026-07-31T18:47:52.039Z",
      "references": [
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3d32be2c-02cd-4210-879a-429ca9d21f99",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1219.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3d32be2c-02cd-4210-879a-429ca9d21f99",
      "modified": "2026-07-31T18:47:52.059Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3d8b368c-57bc-4f36-808a-387a1e2cd3d9",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3d8b368c-57bc-4f36-808a-387a1e2cd3d9",
      "modified": "2026-07-31T18:47:52.082Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--400d9bc6-f30f-473c-b895-41b0ca9dd750",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1239",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--400d9bc6-f30f-473c-b895-41b0ca9dd750",
      "modified": "2026-07-31T18:47:52.107Z",
      "references": [
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "ATTACKIQ MUSTANG PANDA TONESHELL March 2023",
          "url": "https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        },
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta TONESHELL June 2023",
          "url": "https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--415fa019-fdc8-437c-97ca-3f2befd83f4b",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1003.006",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--415fa019-fdc8-437c-97ca-3f2befd83f4b",
      "modified": "2026-07-31T18:47:52.129Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--42440c0c-f28b-4c42-94af-dc4cad6a8dd7",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1218.004",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--42440c0c-f28b-4c42-94af-dc4cad6a8dd7",
      "modified": "2026-07-31T18:47:52.144Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--42641f16-2ef3-4b8e-b4c6-0205a5cb9f1e",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1586.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--42641f16-2ef3-4b8e-b4c6-0205a5cb9f1e",
      "modified": "2026-07-31T18:47:52.168Z",
      "references": [
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--43924791-6149-4869-a30c-0cad37d1e6f6",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0154",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--43924791-6149-4869-a30c-0cad37d1e6f6",
      "modified": "2026-07-31T18:47:52.184Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        },
        {
          "source_name": "McAfee Dianxun March 2021",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--449b3473-a6cc-4934-8441-84325f70e126",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--449b3473-a6cc-4934-8441-84325f70e126",
      "modified": "2026-07-31T18:47:52.203Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49697cc6-d5fe-4a93-afbc-7eb767056021",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1070",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49697cc6-d5fe-4a93-afbc-7eb767056021",
      "modified": "2026-07-31T18:47:52.227Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4c6c38bb-8bb5-48d9-b4f3-54adfca1f902",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1071.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4c6c38bb-8bb5-48d9-b4f3-54adfca1f902",
      "modified": "2026-09-03T19:46:59.460Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "McAfee Dianxun March 2021",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4f31fe80-6994-443d-ad54-7584601618dd",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1018",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4f31fe80-6994-443d-ad54-7584601618dd",
      "modified": "2026-07-31T18:47:52.275Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4fb77ea2-93b7-4459-9aa1-570a1abbbbc1",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1069.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4fb77ea2-93b7-4459-9aa1-570a1abbbbc1",
      "modified": "2026-07-31T18:47:52.299Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5025e4e1-4862-430c-a5fd-8ca7fece809b",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1001.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5025e4e1-4862-430c-a5fd-8ca7fece809b",
      "modified": "2026-09-03T19:46:48.351Z",
      "references": [
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--509f6586-94b5-482b-b0dd-09f704c9417f",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1048.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--509f6586-94b5-482b-b0dd-09f704c9417f",
      "modified": "2026-09-03T19:46:49.539Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--529e6ba3-a73d-4cca-84e9-d2d047340aa0",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--529e6ba3-a73d-4cca-84e9-d2d047340aa0",
      "modified": "2026-07-31T18:47:52.353Z",
      "references": [
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "McAfee Dianxun March 2021",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--56db53fc-6279-48aa-9d70-f72df6d1664a",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1041",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--56db53fc-6279-48aa-9d70-f72df6d1664a",
      "modified": "2026-09-03T19:46:59.083Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--57102d8d-a85f-4a41-9693-cbbfb0d2625c",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1230",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--57102d8d-a85f-4a41-9693-cbbfb0d2625c",
      "modified": "2026-07-31T18:47:52.390Z",
      "references": [
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--58aa294e-c14c-45f8-80e6-9b05229cbb0f",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1072",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--58aa294e-c14c-45f8-80e6-9b05229cbb0f",
      "modified": "2026-07-31T18:47:52.401Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5cad7810-9bad-4d98-9668-fc9e3d1042b8",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1557",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5cad7810-9bad-4d98-9668-fc9e3d1042b8",
      "modified": "2026-07-31T18:47:52.422Z",
      "references": [
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--60ac5ce0-46ef-4448-8d8d-f0efd7d9a691",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1505.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--60ac5ce0-46ef-4448-8d8d-f0efd7d9a691",
      "modified": "2026-07-31T18:47:52.443Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--640596c4-55d0-4d7d-a734-b4cfb864c9f5",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0357",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--640596c4-55d0-4d7d-a734-b4cfb864c9f5",
      "modified": "2026-07-31T18:47:52.462Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--642bdc02-70d1-4916-8cd8-e69ed7979e9e",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1176.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--642bdc02-70d1-4916-8cd8-e69ed7979e9e",
      "modified": "2026-07-31T18:47:52.480Z",
      "references": [
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6450218a-ec88-4144-af94-593828b5638c",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1588.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6450218a-ec88-4144-af94-593828b5638c",
      "modified": "2026-07-31T18:47:52.498Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--65df5b73-98b5-474d-8ee4-0b60b7291712",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1091",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--65df5b73-98b5-474d-8ee4-0b60b7291712",
      "modified": "2026-07-31T18:47:52.515Z",
      "references": [
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--672c21b6-0a54-4b70-8ce0-591cc5a72622",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--672c21b6-0a54-4b70-8ce0-591cc5a72622",
      "modified": "2026-07-31T18:47:52.533Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6a31262f-c7f8-485e-988d-7d3513ddb247",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1234",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6a31262f-c7f8-485e-988d-7d3513ddb247",
      "modified": "2026-07-31T18:47:52.560Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6f8d9c8d-750d-40c2-9722-c000b1efda13",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1052.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6f8d9c8d-750d-40c2-9722-c000b1efda13",
      "modified": "2026-09-02T18:41:22.105Z",
      "references": [
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--714ae0c0-aa49-45c6-a977-c86783f057dc",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1003.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--714ae0c0-aa49-45c6-a977-c86783f057dc",
      "modified": "2026-07-31T18:47:52.609Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--72faebbd-f228-478b-a9aa-21e006acfc9c",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1588.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--72faebbd-f228-478b-a9aa-21e006acfc9c",
      "modified": "2026-07-31T18:47:52.627Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--74cd7fa0-af3f-4f50-ba66-b479b57f8a74",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1588.004",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--74cd7fa0-af3f-4f50-ba66-b479b57f8a74",
      "modified": "2026-07-31T18:47:52.643Z",
      "references": [
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7687477f-ea5e-4a3f-806d-e561f5c8adb4",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7687477f-ea5e-4a3f-806d-e561f5c8adb4",
      "modified": "2026-07-31T18:47:52.664Z",
      "references": [
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--76a98773-f360-4553-b901-bfe14584096c",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1233",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--76a98773-f360-4553-b901-bfe14584096c",
      "modified": "2026-07-31T18:47:52.693Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--77a75897-0325-472b-a7d2-2c5f1faf5d46",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1070.004",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--77a75897-0325-472b-a7d2-2c5f1faf5d46",
      "modified": "2026-07-31T18:47:52.710Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7a520abb-af16-4501-935c-bb13fc490813",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1129",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7a520abb-af16-4501-935c-bb13fc490813",
      "modified": "2026-07-31T18:47:52.731Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--88015217-a3df-4654-bea1-b1d8241b67ee",
      "subject": "ATTACK:enterprise:C0047",
      "predicate": "attributed-to",
      "object": "ATTACK:enterprise:G0129",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--88015217-a3df-4654-bea1-b1d8241b67ee",
      "modified": "2026-07-31T18:47:52.750Z",
      "references": [
        {
          "source_name": "Recorded Future RedDelta 2025",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--881641a8-77d9-4dce-9d4b-2388c9b11612",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1057",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--881641a8-77d9-4dce-9d4b-2388c9b11612",
      "modified": "2026-07-31T18:47:52.780Z",
      "references": [
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--88221b55-8e8a-4a38-b477-a45907083011",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1082",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--88221b55-8e8a-4a38-b477-a45907083011",
      "modified": "2026-07-31T18:47:52.804Z",
      "references": [
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--88640feb-d423-4861-ac34-cb7a8fe4bfac",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1095",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--88640feb-d423-4861-ac34-cb7a8fe4bfac",
      "modified": "2026-09-03T19:46:57.994Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8b2f18e7-8c3c-4d43-a2f9-53f87512f3a2",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1203",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8b2f18e7-8c3c-4d43-a2f9-53f87512f3a2",
      "modified": "2026-07-31T18:47:52.839Z",
      "references": [
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--91c0aeed-d3f8-430a-8443-ff2ae2fa2524",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0645",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--91c0aeed-d3f8-430a-8443-ff2ae2fa2524",
      "modified": "2026-07-31T18:47:52.867Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--93c457f4-550f-431f-8fb3-5798892d3eff",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1574.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--93c457f4-550f-431f-8fb3-5798892d3eff",
      "modified": "2026-07-31T18:47:52.888Z",
      "references": [
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--95cabb2e-3d68-40c9-8e84-14667ef9ef6a",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0552",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--95cabb2e-3d68-40c9-8e84-14667ef9ef6a",
      "modified": "2026-07-31T18:47:52.901Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--97b55f86-908f-4de2-ba9a-d65005b0f4dc",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1608",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--97b55f86-908f-4de2-ba9a-d65005b0f4dc",
      "modified": "2026-07-31T18:47:52.918Z",
      "references": [
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9ce98ef3-1951-460b-93c6-2ded0edc8dfd",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1622",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9ce98ef3-1951-460b-93c6-2ded0edc8dfd",
      "modified": "2026-07-31T18:47:52.939Z",
      "references": [
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Sophos Mustang Panda PLUGX",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9d239fc5-5d40-4991-ae41-761686ab43a2",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9d239fc5-5d40-4991-ae41-761686ab43a2",
      "modified": "2026-07-31T18:47:52.952Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Google TAG Ukraine Threat Landscape March 2022",
          "url": "https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
        },
        {
          "source_name": "Proofpoint TA416 November 2020",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a53771f3-24ed-4799-a1e8-8cf747cbfe4d",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1654",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a53771f3-24ed-4799-a1e8-8cf747cbfe4d",
      "modified": "2026-07-31T18:47:52.969Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ab1b96ad-3ad8-4b16-b886-559f693496ff",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1083",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ab1b96ad-3ad8-4b16-b886-559f693496ff",
      "modified": "2026-07-31T18:47:52.987Z",
      "references": [
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac2b9eab-5d0e-4ab5-9b5b-eebd454737d6",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac2b9eab-5d0e-4ab5-9b5b-eebd454737d6",
      "modified": "2026-07-31T18:47:53.017Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac5c1601-ee79-4d9e-b702-bf1771ee02ef",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1583.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac5c1601-ee79-4d9e-b702-bf1771ee02ef",
      "modified": "2026-07-31T18:47:53.038Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        },
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        },
        {
          "source_name": "McAfee Dianxun March 2021",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac77f5ac-4a6e-4c58-a596-5e9aa6f00ff7",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1574.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac77f5ac-4a6e-4c58-a596-5e9aa6f00ff7",
      "modified": "2026-07-31T18:47:53.055Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "Broadcom",
          "url": "https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"
        },
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        },
        {
          "source_name": "Proofpoint TA416 November 2020",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        },
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        },
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b063f8cf-86d1-47fb-8ada-2b39009ee9e2",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1546.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b063f8cf-86d1-47fb-8ada-2b39009ee9e2",
      "modified": "2026-07-31T18:47:53.079Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6cd360d-5b9a-4504-ac17-e99ebfc8cfdb",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1236",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6cd360d-5b9a-4504-ac17-e99ebfc8cfdb",
      "modified": "2026-07-31T18:47:53.103Z",
      "references": [
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6d01bfe-cff0-4dc1-90e5-0a9fac5d15a9",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1106",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6d01bfe-cff0-4dc1-90e5-0a9fac5d15a9",
      "modified": "2026-07-31T18:47:53.124Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Broadcom",
          "url": "https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"
        },
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        },
        {
          "source_name": "Sophos Mustang Panda PLUGX",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
        },
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        },
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6da41e9-9925-4b83-b9a7-d29509b852de",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1003.003",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6da41e9-9925-4b83-b9a7-d29509b852de",
      "modified": "2026-07-31T18:47:53.141Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b8c62d16-4282-4cb4-a279-fb3427a92099",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b8c62d16-4282-4cb4-a279-fb3427a92099",
      "modified": "2026-07-31T18:47:53.161Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bada215b-a87f-4521-a238-cca525195469",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1228",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bada215b-a87f-4521-a238-cca525195469",
      "modified": "2026-07-31T18:47:53.180Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        },
        {
          "source_name": "PaloAlto MUSTANG PANDA PUBLOAD MARCH 2024",
          "url": "https://unit42.paloaltonetworks.com/chinese-apts-target-asean-entities/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bcb23d08-7670-4373-94a0-370191d01297",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bcb23d08-7670-4373-94a0-370191d01297",
      "modified": "2026-07-31T18:47:53.193Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bee27cd8-cc88-4c96-9709-b0398d7d18bc",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1553.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bee27cd8-cc88-4c96-9709-b0398d7d18bc",
      "modified": "2026-07-31T18:47:53.208Z",
      "references": [
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        },
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        },
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bf522329-9ecb-4674-aa88-9ca94f26dda9",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1227",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bf522329-9ecb-4674-aa88-9ca94f26dda9",
      "modified": "2026-07-31T18:47:53.234Z",
      "references": [
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bf78e7f6-2dc5-4b1b-95bb-03e8e5e0e5a1",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bf78e7f6-2dc5-4b1b-95bb-03e8e5e0e5a1",
      "modified": "2026-07-31T18:47:53.263Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Proofpoint TA416 November 2020",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"
        },
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        },
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        },
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c0561e30-556b-486b-a7fa-1be6feece584",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1547.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c0561e30-556b-486b-a7fa-1be6feece584",
      "modified": "2026-07-31T18:47:53.281Z",
      "references": [
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "Proofpoint TA416 November 2020",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"
        },
        {
          "source_name": "Sophos Mustang Panda PLUGX",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c1e063d7-29dc-476e-a854-3ccd24ddcbbf",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1235",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c1e063d7-29dc-476e-a854-3ccd24ddcbbf",
      "modified": "2026-07-31T18:47:53.301Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c51dce73-f92b-4eaa-b00b-4466f3e3ae09",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1119",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c51dce73-f92b-4eaa-b00b-4466f3e3ae09",
      "modified": "2026-07-31T18:47:53.322Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c592bcf5-6e88-4d77-a274-0a58b7388e76",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1105",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c592bcf5-6e88-4d77-a274-0a58b7388e76",
      "modified": "2026-09-03T19:47:05.072Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c890e6af-c827-4369-a0f7-fb351c6b6ec5",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1074.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c890e6af-c827-4369-a0f7-fb351c6b6ec5",
      "modified": "2026-07-31T18:47:53.371Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cfe7f665-9597-49e5-9d2e-73058147e676",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.007",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cfe7f665-9597-49e5-9d2e-73058147e676",
      "modified": "2026-07-31T18:47:53.394Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d37fac03-0b94-4794-b51a-e7db3d64294b",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d37fac03-0b94-4794-b51a-e7db3d64294b",
      "modified": "2026-07-31T18:47:53.425Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d395d0b1-0ce7-46bf-bf8a-5a031f7bbf78",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0662",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d395d0b1-0ce7-46bf-bf8a-5a031f7bbf78",
      "modified": "2026-07-31T18:47:53.449Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d63355e9-94d1-4eb2-b24d-d8c8b11923ef",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0590",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d63355e9-94d1-4eb2-b24d-d8c8b11923ef",
      "modified": "2026-07-31T18:47:53.469Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d6fb17bf-df52-4eff-b669-c5b77c13e26c",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0012",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d6fb17bf-df52-4eff-b669-c5b77c13e26c",
      "modified": "2026-07-31T18:47:53.491Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d704a927-fe82-4e17-85e9-55009860bd13",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.016",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d704a927-fe82-4e17-85e9-55009860bd13",
      "modified": "2026-07-31T18:47:53.511Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9b5190b-b2af-4673-8a19-b65744b70125",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1232",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9b5190b-b2af-4673-8a19-b65744b70125",
      "modified": "2026-07-31T18:47:53.534Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dc6b1914-e366-45c8-b2f5-c83dbd9cd242",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1070.006",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dc6b1914-e366-45c8-b2f5-c83dbd9cd242",
      "modified": "2026-07-31T18:47:53.557Z",
      "references": [
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e122c13d-078d-4404-b2a0-e0e2341dbd2e",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1204.002",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e122c13d-078d-4404-b2a0-e0e2341dbd2e",
      "modified": "2026-07-31T18:47:53.578Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        },
        {
          "source_name": "Google TAG Ukraine Threat Landscape March 2022",
          "url": "https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        },
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        },
        {
          "source_name": "Sophos Mustang Panda PLUGX",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
        },
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e67a8b60-ef9c-484b-91b4-0594a7b60eb2",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1572",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e67a8b60-ef9c-484b-91b4-0594a7b60eb2",
      "modified": "2026-09-03T19:46:56.972Z",
      "references": [
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e6822e85-5683-498d-8731-a3638c05836d",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S1226",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e6822e85-5683-498d-8731-a3638c05836d",
      "modified": "2026-07-31T18:47:53.625Z",
      "references": [
        {
          "source_name": "Broadcom",
          "url": "https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e8781dcd-4e35-4106-a400-d2f4871b286d",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1036.008",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e8781dcd-4e35-4106-a400-d2f4871b286d",
      "modified": "2026-07-31T18:47:53.643Z",
      "references": [
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e90de84d-a394-4797-834a-12e5849b9e68",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1036.007",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e90de84d-a394-4797-834a-12e5849b9e68",
      "modified": "2026-07-31T18:47:53.665Z",
      "references": [
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        },
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eac3f09f-fdd0-4bbd-965b-4e22276f4021",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1102",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eac3f09f-fdd0-4bbd-965b-4e22276f4021",
      "modified": "2026-09-03T19:46:57.333Z",
      "references": [
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eb3ab439-c88b-4ef5-befd-8a356b6570c5",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1205",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eb3ab439-c88b-4ef5-befd-8a356b6570c5",
      "modified": "2026-07-31T18:47:53.703Z",
      "references": [
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee8e443c-44a7-4480-9d51-b722a311dbab",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0020",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee8e443c-44a7-4480-9d51-b722a311dbab",
      "modified": "2026-07-31T18:47:53.731Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--efe1cabd-63cf-46d6-8010-93504832bc03",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1036.005",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--efe1cabd-63cf-46d6-8010-93504832bc03",
      "modified": "2026-07-31T18:47:53.755Z",
      "references": [
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f2ca9a5f-9f4a-4575-8e28-341417a09dee",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1587.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f2ca9a5f-9f4a-4575-8e28-341417a09dee",
      "modified": "2026-07-31T18:47:53.778Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f5d27f3c-743f-4867-8b18-8eda5527babe",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1027.012",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f5d27f3c-743f-4867-8b18-8eda5527babe",
      "modified": "2026-07-31T18:47:53.802Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "Sophos Mustang Panda PLUGX",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fc7c27b4-e18f-486a-b7f8-9eb61eec23f2",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:S0013",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fc7c27b4-e18f-486a-b7f8-9eb61eec23f2",
      "modified": "2026-07-31T18:47:53.831Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        },
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        },
        {
          "source_name": "Sophos PlugX September 2022",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.