Mustang Panda has used

Mustang Panda has encrypted C2 communications with RC4.(Citation: Recorded Future REDDELTA July 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Mustang Panda has used

Mustang Panda has downloaded additional executables following the initial infection stage.(Citation: Recorded Future REDDELTA July 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Mustang Panda has created the registry key

Mustang Panda's

PlugX variant has created a hidden folder on USB drives named

Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.(Citation: Avira Mustang Panda January 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Mustang Panda has delivered malicious links to their intended targets.(Citation: McAfee Dianxun March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

Mustang Panda used custom batch scripts to collect files automatically from a targeted system.(Citation: Secureworks BRONZE PRESIDENT December 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Mustang Panda has installed TeamViewer on targeted systems.(Citation: Secureworks BRONZE PRESIDENT December 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|

Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file.

Mustang Panda has also used

Mustang Panda has stored collected credential files in