Mustang Panda - G0129

Created: 2021-04-12T15:56:28.861Z

Modified: 2023-03-22T22:01:13.781Z

Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

Mustang Panda,TA416,RedDelta,BRONZE PRESIDENT

Description

Mustang Panda is a China-based cyber espionage threat actor that was first observed in 2017 but may have been conducting operations since at least 2014. Mustang Panda has targeted government entities, nonprofits, religious, and other non-governmental organizations in the U.S., Europe, Mongolia, Myanmar, Pakistan, and Vietnam, among others.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)

Techniques Used

Mustang Panda has delivered web bugs to profile their intended targets.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

Mustang Panda has hosted malicious payloads on DropBox including

PlugX.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

Mustang Panda has used DropBox URLs to deliver variants of

PlugX.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|PRE|T1608|Stage Capabilities|

Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|Windows|T1036.007|Double File Extension|