PUBLOAD
Software · ATTACK:enterprise:S1228
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1228",
"title": "PUBLOAD",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1228",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--3824852d-1957-4712-9da0-38143723c060",
"external_id": "S1228",
"domain": "enterprise",
"created": "2025-08-04T16:35:44.800Z",
"modified": "2026-05-12T15:12:00.733Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
"url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
},
{
"source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
"url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
}
]
}Explicit source assertions (36)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01c84feb-9dcf-455f-8900-fba08e8e7bc3
Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Palo Alto Networks, Unit 42ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--085c21c0-4afb-4df2-bf86-803457be16fd
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d32eeca-9be9-4d2a-85cd-0cbe91b12be8
CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22e70d45-8ca7-4a05-a22a-ffd5ffdd5f61
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39aa1d6a-fbd7-40cf-90ea-4e83ba2c45cd
CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1001.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bd961d2-39f1-4ed0-a42e-1a9e00ecc2de
Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Palo Alto Networks, Unit 42ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cb2ba08-aebd-47f2-b1ea-9e28a2f64f77
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · 2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5013757f-2af8-43ce-b0cd-b625ca0bcf58
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · 2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5123b96d-ad7e-43e5-8de6-88bcd47b1ddb
Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · Palo Alto Networks, Unit 42ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57391d02-a8bd-432e-866a-6e23e4ac8329
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024 · 2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bb98e61-548f-4ba0-9a25-50cbca531826
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Palo Alto Networks, Unit 42ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1071.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64d956d3-7818-47a1-ad3b-c7c5588117eb
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1016.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66076fd1-fad1-4296-b96c-abbda87b2abd
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6961d915-0d1e-4d5b-8a4a-163ce529fdaf
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · 2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c4292e7-a284-4524-8efc-1d8e205f6eed
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Palo Alto Networks, Unit 42 · PaloAlto MUSTANG PANDA PUBLOAD MARCH 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6dbc5da4-3b3a-4662-bf05-c11e006b79d9
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e11a24f-8194-4d7c-884c-ef6390955b04
2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDAATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ed4668e-05c7-4d5f-9221-ffa2027f7100
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c9ecd8e-44d6-4e03-84c6-ff6f44b3bc33
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f43c516-a7f0-4d72-82ae-cd9c8eda4ffc
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024 · 2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--921bebc2-f400-4eaa-8b9d-504221958e76
Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Palo Alto Networks, Unit 42ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a8c6873-9807-4a83-99b0-16acd96ffde8
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a38cfd4a-0ba2-49ae-98e9-df6c1f954148
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6fd818c-d0a6-44ca-b80d-abb80af9acac
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S1228
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bada215b-a87f-4521-a238-cca525195469
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Palo Alto Networks, Unit 42 · PaloAlto MUSTANG PANDA PUBLOAD MARCH 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c174f9d0-513c-440a-8a99-65eb68b494bb
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1205
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc0c7d4b-eebb-4e95-9e03-972b1e943208
CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · PaloAlto MUSTANG PANDA PUBLOAD MARCH 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdbb0dc8-23e3-4dad-a2a8-52240353f587
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d234a6a0-b859-430c-a2e6-89c5509e2fa1
CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024 · Palo Alto Networks, Unit 42ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2543f5c-6079-4540-8250-d4b900b64f42
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d579558d-586a-4d4c-a10e-9860d61c7232
2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDAATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e002fb3d-e0f7-4f37-90ff-e388e4aaeb80
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1ffe097-446d-4a68-b273-efee58aa110c
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2498e90-b4dc-4ef4-b1e5-d34537a2f4b2
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0fb848a-8237-4887-b2cf-f916d477a92c
2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff57d2d8-095c-4f9b-bb57-bc0971bb6a8d
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload