Início / Grupos de ameaça / Mustang Panda

Mustang Panda G0129

🔔 Criar alerta

Também conhecido como: TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

1

CVEs associadas

97

Técnicas

23

Malwares e ferramentas

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2017-0199 Alta · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability

“Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.”

Técnicas por tática

Reconhecimento

T1593 Search Open Websites/Domains T1598.003 Spearphishing Link

Desenvolvimento de recursos

T1583.001 Domains T1583.006 Web Services T1585.002 Email Accounts T1586.002 Email Accounts T1587.001 Malware T1588.002 Tool T1588.003 Code Signing Certificates T1588.004 Digital Certificates T1608 Stage Capabilities T1608.001 Upload Malware

Acesso inicial

T1091 Replication Through Removable Media T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.007 JavaScript T1072 Software Deployment Tools T1106 Native API T1129 Shared Modules T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1574.001 DLL T1574.005 Executable Installer File Permissions Weakness

Persistência

T1053.005 Scheduled Task T1176.002 IDE Extensions T1205 Traffic Signaling T1505.003 Web Shell T1546.003 Windows Management Instrumentation Event Subscription T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1546.003 Windows Management Instrumentation Event Subscription T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027 Obfuscated Files or Information T1027.007 Dynamic API Resolution T1027.012 LNK Icon Smuggling T1027.016 Junk Code Insertion T1036.005 Match Legitimate Resource Name or Location T1036.007 Double File Extension T1036.008 Masquerade File Type T1070 Indicator Removal T1070.004 File Deletion T1070.006 Timestomp T1140 Deobfuscate/Decode Files or Information T1205 Traffic Signaling T1218.004 InstallUtil T1218.005 Mshta T1564.001 Hidden Files and Directories T1574.001 DLL T1574.005 Executable Installer File Permissions Weakness T1622 Debugger Evasion T1678 Delay Execution

Comprometimento de defesas

T1553.002 Code Signing

Acesso a credenciais

T1003 OS Credential Dumping T1003.001 LSASS Memory T1003.003 NTDS T1003.006 DCSync T1557 Adversary-in-the-Middle

Descoberta

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1518 Software Discovery T1622 Debugger Evasion T1654 Log Enumeration

Movimento lateral

T1072 Software Deployment Tools T1091 Replication Through Removable Media

Coleta

T1074.001 Local Data Staging T1119 Automated Collection T1557 Adversary-in-the-Middle T1560.001 Archive via Utility T1560.003 Archive via Custom Method

Comando e controle

T1001.003 Protocol or Service Impersonation T1071.001 Web Protocols T1095 Non-Application Layer Protocol T1102 Web Service T1105 Ingress Tool Transfer T1205 Traffic Signaling T1219.001 IDE Tunneling T1219.002 Remote Desktop Software T1572 Protocol Tunneling T1573.001 Symmetric Cryptography

Exfiltração

T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1052.001 Exfiltration over USB T1567.002 Exfiltration to Cloud Storage

Malwares e ferramentas

BOOKWORMMalwareS1226
CANONSTAGERMalwareS1237
China ChopperMalwareS0020
CLAIMLOADERMalwareS1236
Cobalt StrikeMalwareS0154
CorKLOGMalwareS1235
HIUPANMalwareS1230
PAKLOGMalwareS1233
PlugXMalwareS0013
PoisonIvyMalwareS0012
PUBLOADMalwareS1228
RCSessionMalwareS0662
ShadowPadMalwareS0596
SplatCloakMalwareS1234
SplatDropperMalwareS1232
StarProxyMalwareS1227
STATICPLUGINMalwareS1238
TONESHELLMalwareS1239
AdFindFerramentaS0552
ImpacketFerramentaS0357
MimikatzFerramentaS0002
NBTscanFerramentaS0590
WevtutilFerramentaS0645

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.