Loading threat actor…
UNK_SteadySplit is a China-aligned espionage threat cluster tracked as part of the broader activity commonly associated with Mustang Panda. Known aliases include CerenaKeeper and Red Ishtar. Reporting places it alongside TA416 as one of two primary clusters within the wider Mustang Panda ecosystem, with historical technical overlaps suggesting some organizational, personnel, or hierarchical relationship, although the exact relationship remains unresolved. UNK_SteadySplit is associated with state-backed cyber espionage activity. It is linked by overlap to operations involving government, diplomatic, and related strategic targets, and sits within a broader intrusion set known for targeting governmental, diplomatic, non-governmental, research, religious, and policy-focused organizations across Europe and Asia. Historical overlap with TA416 indicates shared tradecraft or infrastructure lineage, but available information does not support collapsing the two clusters into a single fully equivalent designation. The broader Mustang Panda ecosystem is known for phishing-led intrusion activity, reconnaissance against intended victims, malware delivery through archive-based lures, and deployment of backdoors including PlugX through DLL sideloading. Overlap between UNK_SteadySplit and TA416 has included references to TONESHELL infrastructure in artifacts used during TA416 campaigns, reinforcing an assessed connection between the clusters. However, recent campaigns did not show the same overlap, and attribution boundaries between the clusters remain analytically distinct. Given the available high-confidence information, UNK_SteadySplit should be understood as a Chinese espionage cluster related to, but operationally distinguished from, TA416 within the Mustang Panda umbrella.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
2 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A second Proofpoint-tracked cluster associated with Mustang Panda activity; prior research identified technical overlaps with TA416, suggesting some organizational, personnel, or hierarchical link, though the exact relationship remains unclear.
A distinct cluster associated in public reporting with the broader Mustang Panda umbrella, primarily targeting government, hospitality, technology, insurance, and energy organizations in South and Southeast Asia, especially Myanmar and Thailand, using phishing-delivered malware including TONESHELL and PUBLOAD.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.