Mustang Panda
Mustang Panda is a Chinese espionage threat actor. The provided content links the group to Chinese interests and notes overlap with TA416 and RedDelta; aliases in the source also include Bronze President, Camaro Dragon, Earth Preta, HoneyMyte, LuminousMoth, Red Lich, Stately Taurus, Tantalum, Temp.Hex, Twill Typhoon, and UNC6384. The content also references a reported link between the RA Group/RA World ransomware operation and Mustang Panda. In the provided material, Mustang Panda is notably associated with PlugX. Researchers have largely attributed PlugX compromises to espionage operators tied to Chinese interests, especially Mustang Panda, though the content notes speculation that PlugX source code may have circulated more broadly. A Mustang Panda PlugX variant created a hidden RECYCLE.BIN folder on USB drives to store malicious executables and collected data. The group is also described as hosting malicious payloads on Dropbox, including PlugX. Observed tradecraft in the source includes PowerShell execution; command and scripting interpreter use; sending malicious files that require direct victim interaction to execute; use of custom batch scripts to automatically collect files from targeted systems; and use of hidden storage on removable media. The content also associates Mustang Panda with Cisco IOS XE Guestshell enablement and destruction activity in a Splunk analytic annotation. Related activity attributed to the overlapping alias LuminousMoth in the provided content includes use of HTTP for command and control, hosting payloads on Dropbox, scanning for files in Documents, Desktop, Downloads, and other drives, collecting usernames via a malicious DLL, storing malicious binaries in hidden directories on victims' USB drives, obtaining malware such as Cobalt Strike, and splitting archived files into multiple parts to bypass a 5 MB limit.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇩🇪 Germany
- 🇮🇹 Italy
- 🇫🇷 France
- 🇪🇸 Spain
- 🇬🇧 United Kingdom
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
58 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
46 malware families attributed to this actor across reporting.
41 additional families tracked in Mallory.
Associated vulnerabilities
15 CVEs this actor has used in observed campaigns. 15 of them exploited in the wild.
Microsoft has been aware of the flaw, tracked as CVE-2025-9491, at least since September 2024, when the Zero Day Initiative identified it as ZDI-25-148 and ZDI-CAN-25373 and notified Redmond. The vulnerability exists in how Windows processes .lnk files, which are desktop icons acting as a shortcut to another file or application.
...used exploits for... Word (CVE-2017-0199)...
Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices... APT29 has exploited ... CVE-2018-13379 for FortiGate VPNs... Dragonfly ... exploited ... CVE-2018-13379 for Fortinet VPNs... Magic Hound ... exploited ... Fortios SSL VPNs (CVE-2018-13379). Play ... including CVE-2018-13379 ... in FortiOS.
Details on Exploited Vulnerabilities ... CVE-2021-1675 Microsoft Windows ... YARA Rules ... reference = “... PrintNightmare and MSHTML exploits” ... $cve1 = “CVE-2021-1675”
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
10 more CVEs tied to this actor tracked in Mallory.
Observables
677 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as one of the Chinese cyber threat groups used by researchers to label MSS-linked activity targeting Europe.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Conducting a multi-stage malware campaign delivering PlugX RAT, using layered execution and evasion techniques, and targeting government and diplomatic entities.
Referenced as a group previously observed using vmtools.dll as a sideloading target.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.