Mofang
Also known as Superman, BRONZE WALKER
Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.(Citation: FOX-IT May 2016 Mofang)
Targets: Government, Private sector, Myanmar, Germany, Singapore, Canada, India, United States, South Korea
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
Recent activity
- 3 Charged in Scheme to Use AI to Impersonate CEOs and Attorneys to Steal $129 Millionnews · Nov 6, 2026
- Show HN: Uncracked City, detective game where you question LLM suspects that liehn · Nov 4, 2026
- Show HN: Uncracked City, detective game where you question LLM suspects that liehn · Nov 4, 2026
- # chrome extension Superman Movie 2025 Live seems malicious. Its # cybersecurity badness score is 88/100! ```json { id : ocjmkldgcdaifpehbcmpkhckdbpghpkb , scormastodon · Oct 26, 2026
References
- https://blog.fox-it.com/2016/06/15/mofang-a-politically-motivated-information-stealing-adversary/
- https://www.cfr.org/interactive/cyber-operations/mofang
- https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf
- https://www.secureworks.com/research/threat-profiles/bronze-walker
- https://attack.mitre.org/groups/G0103
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.