Actors/Nation-state / APT/Asia

Mustang Panda

G0129APTCN · China

AKA Camaro Dragon · Stately Taurus · HoneyMyte · BASIN · Earth Preta · PKPLUG · LuminousMoth

PwC: RedDeltaMandiant: Temp.HexMicrosoft: Twill TyphoonProofpoint: TA416Secureworks: BRONZE PRESIDENTMITRE: G0129

China-aligned cyber-espionage group targeting NGOs, religious orgs, and governments across Asia and Europe.

Targets25

Sectors11

Threat types1

GIRs covered0/480

Active since2014

Also tracked as

7 vendor names · 7 other aliases

Open Rosetta Stone

CrowdStrike

Mustang Panda

Mandiant

Temp.Hex

Microsoft

Twill Typhoon

MITRE

G0129

Proofpoint

TA416

PwC

RedDelta

Secureworks

BRONZE PRESIDENT

UNATTRIBUTED ALIASESCamaro DragonStately TaurusHoneyMyteBASINEarth PretaPKPLUGLuminousMoth

Victimology

Geographic footprint · 25 countries

origin · Chinatargeted countries · 25

EUROPE · 11

Belgium · Germany · France · Hungary · Italy · Montenegro · Poland · Serbia · Slovakia · Ukraine · Vatican City

ASIA · 11

Israel · Kazakhstan · Myanmar · Mongolia · Malaysia · Nepal · Philippines · Pakistan · Thailand · Taiwan · Vietnam

AFRICA · 2

Mauritius · Zimbabwe

AMERICAS · 1

United States

Sectors targeted

11 of 40

Government100 actors Defense72 actors Financial Services74 actors Healthcare47 actors Technology60 actors Telecom72 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Education & Research62 actors Manufacturing (man)50 actors Extractive Industries8 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 60 techniques

Reconnaissance · 1

T1593Search Open Websites/Domains

Resource Development · 2

T1583.006Web Services T1608Stage Capabilities

Initial Access · 2

T1566.001Spearphishing Attachment

Execution · 12

T1047Windows Management Instrumentation

Persistence · 2

T1176.002IDE Extensions

Credential Access · 5

T1003OS Credential Dumping

Discovery · 8

T1016System Network Configuration Discovery

Lateral Movement · 1

T1091Replication Through Removable Media

Collection · 3

T1119Automated Collection T1560.001Archive via Utility

Exfiltration · 3

T1041Exfiltration Over C2 Channel T1048.003Exfiltration Over Unencrypted Non-C2 Protocol T1567.002Exfiltration to Cloud Storage

Command And Control · 7

T1001.003Protocol or Service Impersonation T1071.001Web Protocols

Stealth · 14

T1027Obfuscated Files or Information

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer60 techniques · layer format 4.5

Related actors

By origin and actor type

T1566.002

Spearphishing Link

T1053.005

Scheduled Task

T1059Command and Scripting Interpreter

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1059.007JavaScript

T1072Software Deployment Tools

T1106Native API

T1129Shared Modules

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1547.001

Registry Run Keys / Startup Folder

T1003.001

LSASS Memory

T1003.003NTDS

T1003.006DCSync

T1557Adversary-in-the-Middle

T1018

Remote System Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1083File and Directory Discovery

T1518Software Discovery

T1654Log Enumeration

T1560.003

Archive via Custom Method

T1095

Non-Application Layer Protocol

T1102Web Service

T1105Ingress Tool Transfer

T1219.001IDE Tunneling

T1219.002Remote Desktop Software

T1027.007

Dynamic API Resolution

T1036.005Match Legitimate Resource Name or Location

T1036.007Double File Extension

T1036.008Masquerade File Type

T1070Indicator Removal

T1070.004File Deletion

T1140Deobfuscate/Decode Files or Information

T1205Traffic Signaling

T1218.004InstallUtil

T1218.005Mshta

T1564.001Hidden Files and Directories

T1622Debugger Evasion

T1678Delay Execution