State-backedChina MITRE G0129

MUSTANG PANDA

Also known as BRONZE PRESIDENT, HoneyMyte, Red Lich, TEMP.HEX, BASIN, Earth Preta, TA416, Stately Taurus, LuminousMoth, Polaris, TANTALUM, Twill Typhoon, BASIN CASTLE, ITG27, Hive0154, UNK_SteadySplit, RedDelta, FIREANT, CAMARO DRAGON, LUMINOUS MOTH

2mentions, 7 days

2mentions, 30 days

Nov 4, 2026last mentioned

This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes. In April 2017, CrowdStrike Falcon Intelligence observed a previously unattributed actor group with a Chinese nexus targeting a U.S.-based think tank. Further analysis revealed a wider campaign with unique tactics, techniques, and procedures (TTPs). This adversary targets non-governmental organizations (NGOs) in general, but uses Mongolian language decoys and themes, suggesting this actor has a specific focus on gathering intelligence on Mongolia. These campaigns involve the use of shared malware like Poison Ivy or PlugX. Recently, Falcon Intelligence observed new activity from MUSTANG PANDA, using a unique infection chain to target likely Mongolia-based victims. This newly observed activity uses a series of redirections and fileless, malicious implementations of legitimate tools to gain access to the targeted systems. Additionally, MUSTANG PANDA actors reused previously-observed legitimate domains to host files.

Targets: Civil society, United States, Germany

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1001.003 Protocol or Service Impersonation T1003 OS Credential Dumping T1003.001 LSASS Memory T1003.003 NTDS T1003.006 DCSync T1016 System Network Configuration Discovery T1018 Remote System Discovery T1027 Obfuscated Files or Information T1027.007 Dynamic API Resolution T1027.012 LNK Icon Smuggling T1027.016 Junk Code Insertion T1036.005 Match Legitimate Resource Name or Location T1036.007 Double File Extension T1036.008 Masquerade File Type T1041 Exfiltration Over C2 Channel T1046 Network Service Discovery T1047 Windows Management Instrumentation T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1049 System Network Connections Discovery T1052.001 Exfiltration over USB T1053.005 Scheduled Task T1057 Process Discovery T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.007 JavaScript T1069.002 Domain Groups T1070 Indicator Removal T1070.004 File Deletion T1070.006 Timestomp T1071.001 Web Protocols T1072 Software Deployment Tools T1074.001 Local Data Staging T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1091 Replication Through Removable Media T1095 Non-Application Layer Protocol T1102 Web Service T1105 Ingress Tool Transfer T1106 Native API T1119 Automated Collection T1129 Shared Modules T1140 Deobfuscate/Decode Files or Information T1176.002 IDE Extensions T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1205 Traffic Signaling T1218.004 InstallUtil T1218.005 Mshta T1219.001 IDE Tunneling T1219.002 Remote Desktop Software T1505.003 Web Shell T1518 Software Discovery T1546.003 Windows Management Instrumentation Event Subscription T1547.001 Registry Run Keys / Startup Folder T1553.002 Code Signing T1557 Adversary-in-the-Middle T1560.001 Archive via Utility T1560.003 Archive via Custom Method T1564.001 Hidden Files and Directories T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1567.002 Exfiltration to Cloud Storage T1572 Protocol Tunneling T1573.001 Symmetric Cryptography T1574.001 DLL T1574.005 Executable Installer File Permissions Weakness T1583.001 Domains T1583.006 Web Services T1585.002 Email Accounts T1586.002 Email Accounts T1587.001 Malware T1588.002 Tool T1588.003 Code Signing Certificates T1588.004 Digital Certificates T1593 Search Open Websites/Domains T1598.003 Spearphishing Link

Recent activity

A four-GPU Radeon RX 470 board with 32GB of GDDR5 and four 8-pin plugs has surfaced. Here is what is known about it and what is still unclear. # RadeonRX470 # A
mastodon · Nov 4, 2026
Quili AI
hn · Nov 3, 2026

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.