Home / Threat actors / Mustang Panda

Mustang Panda G0129

🔔 Create alert

Also known as: TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1

associated CVEs

97

Techniques

23

Malware and tools

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2017-0199 High · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability

“Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.”

Techniques by tactic

Reconnaissance

T1593 Search Open Websites/Domains T1598.003 Spearphishing Link

Resource Development

T1583.001 Domains T1583.006 Web Services T1585.002 Email Accounts T1586.002 Email Accounts T1587.001 Malware T1588.002 Tool T1588.003 Code Signing Certificates T1588.004 Digital Certificates T1608 Stage Capabilities T1608.001 Upload Malware

Initial Access

T1091 Replication Through Removable Media T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.007 JavaScript T1072 Software Deployment Tools T1106 Native API T1129 Shared Modules T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1574.001 DLL T1574.005 Executable Installer File Permissions Weakness

Persistence

T1053.005 Scheduled Task T1176.002 IDE Extensions T1205 Traffic Signaling T1505.003 Web Shell T1546.003 Windows Management Instrumentation Event Subscription T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled Task T1546.003 Windows Management Instrumentation Event Subscription T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027 Obfuscated Files or Information T1027.007 Dynamic API Resolution T1027.012 LNK Icon Smuggling T1027.016 Junk Code Insertion T1036.005 Match Legitimate Resource Name or Location T1036.007 Double File Extension T1036.008 Masquerade File Type T1070 Indicator Removal T1070.004 File Deletion T1070.006 Timestomp T1140 Deobfuscate/Decode Files or Information T1205 Traffic Signaling T1218.004 InstallUtil T1218.005 Mshta T1564.001 Hidden Files and Directories T1574.001 DLL T1574.005 Executable Installer File Permissions Weakness T1622 Debugger Evasion T1678 Delay Execution

Defense Impairment

T1553.002 Code Signing

Credential Access

T1003 OS Credential Dumping T1003.001 LSASS Memory T1003.003 NTDS T1003.006 DCSync T1557 Adversary-in-the-Middle

Discovery

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1518 Software Discovery T1622 Debugger Evasion T1654 Log Enumeration

Lateral Movement

T1072 Software Deployment Tools T1091 Replication Through Removable Media

Collection

T1074.001 Local Data Staging T1119 Automated Collection T1557 Adversary-in-the-Middle T1560.001 Archive via Utility T1560.003 Archive via Custom Method

Command and Control

T1001.003 Protocol or Service Impersonation T1071.001 Web Protocols T1095 Non-Application Layer Protocol T1102 Web Service T1105 Ingress Tool Transfer T1205 Traffic Signaling T1219.001 IDE Tunneling T1219.002 Remote Desktop Software T1572 Protocol Tunneling T1573.001 Symmetric Cryptography

Exfiltration

T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1052.001 Exfiltration over USB T1567.002 Exfiltration to Cloud Storage

Malware and tools

BOOKWORMMalwareS1226
CANONSTAGERMalwareS1237
China ChopperMalwareS0020
CLAIMLOADERMalwareS1236
Cobalt StrikeMalwareS0154
CorKLOGMalwareS1235
HIUPANMalwareS1230
PAKLOGMalwareS1233
PlugXMalwareS0013
PoisonIvyMalwareS0012
PUBLOADMalwareS1228
RCSessionMalwareS0662
ShadowPadMalwareS0596
SplatCloakMalwareS1234
SplatDropperMalwareS1232
StarProxyMalwareS1227
STATICPLUGINMalwareS1238
TONESHELLMalwareS1239
AdFindToolS0552
ImpacketToolS0357
MimikatzToolS0002
NBTscanToolS0590
WevtutilToolS0645

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.