MITRE ATT&CK / Groups / G0129

Mustang Panda

ID
G0129
Associated names
TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad
Source
attack.mitre.org
MITRE last modified
1 Aug 2026

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Techniques used (85)

Software used (23)

References

  1. BlackBerry MUSTANG PANDA October 2022
  2. Eset PlugX Korplug Mustang Panda March 2022
  3. Anomali MUSTANG PANDA October 2019
  4. Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022
  5. Secureworks BRONZE PRESIDENT December 2019
  6. DOJ Affidavit Search and Seizure PlugX December 2024
  7. EclecticIQ Mustang Panda PlugX
  8. ATTACKIQ MUSTANG PANDA TONESHELL March 2023
  9. Crowdstrike MUSTANG PANDA June 2018
  10. Palo Alto Networks, Unit 42
  11. Sophos PlugX September 2022
  12. Sophos Mustang Panda PLUGX
  13. Zscaler