MUSTANG PANDA

ChinaState-sponsoredUnknown

Techniques

Reports

Latest observed activity: No dated reports available
First observed: —

Profile

This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes. In April 2017, CrowdStrike Falcon Intelligence observed a previously unattributed actor group with a Chinese nexus targeting a U.S.-based think tank. Further analysis revealed a wider campaign with unique tactics, techniques, and procedures (TTPs). This adversary targets non-governmental organizations (NGOs) in general, but uses Mongolian language decoys and themes, suggesting this actor has a specific focus on gathering intelligence on Mongolia. These campaigns involve the use of shared malware like Poison Ivy or PlugX. Recently, Falcon Intelligence observed new activity from MUSTANG PANDA, using a unique infection chain to target likely Mongolia-based victims. This newly observed activity uses a series of redirections and fileless, malicious implementations of legitimate tools to gain access to the targeted systems. Additionally, MUSTANG PANDA actors reused previously-observed legitimate domains to host files.

Relevance for Germany, Austria and Switzerland

high

Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

Target sectors according to source

Civil society

Target countries according to source United States, Germany

Aliases

BRONZE PRESIDENT
HoneyMyte
Red Lich
TEMP.HEX
BASIN
Earth Preta
TA416
Stately Taurus
LuminousMoth
Polaris
TANTALUM
Twill Typhoon
BASIN CASTLE
ITG27
Hive0154
Mustang Panda
UNK_SteadySplit

MITRE ATT&CK techniques

Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.

Software / tooling used

ATT&CK campaigns

Linked ATT&CK campaign profiles in which this group is named as an actor.

C0047

External references

Back to group overview