Actors/Nation-state / APT/Asia

Mustang Panda

APTCN · China

AKA Camaro Dragon · Stately Taurus · HoneyMyte · BASIN · Earth Preta · PKPLUG

Mandiant: Temp.HexMicrosoft: Twill TyphoonProofpoint: TA416PwC: RedDeltaSecureworks: BRONZE PRESIDENT

China-aligned cyber-espionage group targeting NGOs, religious orgs, and governments across Asia and Europe.

Targets25

Sectors11

Threat types1

GIRs covered0/480

Active since2014

Victimology

Geographic footprint · 25 countries

origin · Chinatargeted countries · 25

EUROPE · 11

Belgium · Germany · France · Hungary · Italy · Montenegro · Poland · Serbia · Slovakia · Ukraine · Vatican City

ASIA · 11

Israel · Kazakhstan · Myanmar · Mongolia · Malaysia · Nepal · Philippines · Pakistan · Thailand · Taiwan · Vietnam

AFRICA · 2

Mauritius · Zimbabwe

AMERICAS · 1

United States

Sectors targeted

11 of 40

Government83 actors Defense60 actors Financial Services61 actors Healthcare38 actors Technology51 actors Telecom57 actors NGOs & Dissidents47 actors Energy / Utilities49 actors Education & Research50 actors Manufacturing (man)40 actors Extractive Industries8 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 60 techniques

Reconnaissance · 1

T1593Search Open Websites/Domains

Resource Development · 2

T1583.006Web Services T1608Stage Capabilities

Initial Access · 2

T1566.001Spearphishing Attachment

Execution · 12

T1047Windows Management Instrumentation

Persistence · 2

T1176.002IDE Extensions

Credential Access · 5

T1003OS Credential Dumping

Discovery · 8

T1016System Network Configuration Discovery

Lateral Movement · 1

T1091Replication Through Removable Media

Collection · 3

T1119Automated Collection T1560.001Archive via Utility

Exfiltration · 3

T1041Exfiltration Over C2 Channel T1048.003Exfiltration Over Unencrypted Non-C2 Protocol T1567.002Exfiltration to Cloud Storage

Command And Control · 7

T1001.003Protocol or Service Impersonation T1071.001Web Protocols

Stealth · 14

T1027Obfuscated Files or Information

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

T1566.002

Spearphishing Link

T1053.005

Scheduled Task

T1059Command and Scripting Interpreter

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1059.007JavaScript

T1072Software Deployment Tools

T1106Native API

T1129Shared Modules

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1547.001

Registry Run Keys / Startup Folder

T1003.001

LSASS Memory

T1003.003NTDS

T1003.006DCSync

T1557Adversary-in-the-Middle

T1018

Remote System Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1083File and Directory Discovery

T1518Software Discovery

T1654Log Enumeration

T1560.003

Archive via Custom Method

T1095

Non-Application Layer Protocol

T1102Web Service

T1105Ingress Tool Transfer

T1219.001IDE Tunneling

T1219.002Remote Desktop Software

T1027.007

Dynamic API Resolution

T1036.005Match Legitimate Resource Name or Location

T1036.007Double File Extension

T1036.008Masquerade File Type

T1070Indicator Removal

T1070.004File Deletion

T1140Deobfuscate/Decode Files or Information

T1205Traffic Signaling

T1218.004InstallUtil

T1218.005Mshta

T1564.001Hidden Files and Directories

T1622Debugger Evasion

T1678Delay Execution