Quick links
Press Enter to search, Esc to close
Threat group profile
MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court documents, says the PRC government paid the group to develop a version of PlugX.
In short
MITRE ATT&CK describes Mustang Panda as a China-based cyber espionage threat actor, and the US Department of Justice, citing court documents, says the PRC government paid the group to develop a version of PlugX. It is said to target governments, diplomats, think tanks and civil society through phishing emails with decoy documents.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Mustang Panda | MITRE ATT&CK; US Department of Justice; CISA-led guidance; ENISA and CERT-EU[1, 3, 5, 8] |
| TA416 | MITRE ATT&CK Associated Groups; CISA-led guidance; ENISA and CERT-EU[1, 5, 8] |
| RedDelta | MITRE ATT&CK Associated Groups; CISA-led guidance; ENISA and CERT-EU[1, 5, 8] |
| BRONZE PRESIDENT | MITRE ATT&CK Associated Groups; CISA-led guidance[1, 5] |
| STATELY TAURUS | MITRE ATT&CK Associated Groups[1] |
| FIREANT | MITRE ATT&CK Associated Groups[1] |
| CAMARO DRAGON | MITRE ATT&CK Associated Groups[1] |
| EARTH PRETA | MITRE ATT&CK Associated Groups[1] |
| HIVE0154 | MITRE ATT&CK Associated Groups[1] |
| TWILL TYPHOON | MITRE ATT&CK Associated Groups; US Department of Justice press release and affidavit[1, 3, 4] |
| TANTALUM | MITRE ATT&CK Associated Groups[1] |
| LUMINOUS MOTH | MITRE ATT&CK Associated Groups[1] |
| UNC6384 | MITRE ATT&CK Associated Groups[1] |
| TEMP.Hex | MITRE ATT&CK Associated Groups; ENISA and CERT-EU[1, 8] |
| Red Lich | MITRE ATT&CK Associated Groups[1] |
| ClumsyToad | MITRE ATT&CK Associated Groups[1] |
| HoneyMyte | ENISA and CERT-EU joint publication JP-23-01 (not on the MITRE list)[8] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK page modified 31 July 2026
Describes Mustang Panda as a China-based cyber espionage threat actor that has been conducting operations since at least 2012.[1]
ENISA and CERT-EU 15 February 2023
Said commercial firms indicated that Mustang Panda is likely operating from the territory of China, and that recent operations of the six named groups focused mainly on information theft.[8]
CISA, FBI and partner agencies 14 May 2024
Describe Mustang Panda as a group affiliated with the PRC that focuses on political espionage. The Canadian Cyber Centre and Japan's National Police Agency published the same text.[5, 6, 7]
CERT-EU February 2024
Said Mustang Panda is attributed by reliable sources to China, in its yearly threat report for 2023.[9]
US Department of Justice 14 January 2025
Said a group of hackers sponsored by the PRC, known to the private sector as Mustang Panda and Twill Typhoon, used a version of PlugX, and that court documents say the PRC government paid the group to develop it.[3]
FBI (affidavit) unsealed with the 14 January 2025 announcement
Stated that it assesses Mustang Panda takes payment from the Chinese government in exchange for providing malware, including PlugX, and other computer intrusion services.[4]
CERT-EU 3 February 2025
Described PlugX as allegedly deployed by China-backed hackers Mustang Panda and Twill Typhoon, when reporting the Justice Department announcement.[13]
CERT-EU 1 July 2026
Called the group China-linked and described a June 2026 phishing campaign as possible, not confirmed.[14]
Sources differ on the start year. MITRE ATT&CK says the group has operated since at least 2012. The US Department of Justice affidavit says China-based state-sponsored hackers have used PlugX since at least 2014. ENISA and CERT-EU say the group was first observed in 2017 and has possibly been operating since at least 2014.
Sources also differ in strength on who stands behind it. MITRE says China-based. CERT-EU says China-linked and, in 2023, repeated that commercial firms indicated it likely operates from Chinese territory. The US Department of Justice goes further: citing court documents, it says the PRC government paid the group to develop a version of PlugX, and the FBI says it assesses the group takes payment from the Chinese government. No source opened names a specific Chinese agency.
Each entry is attributed to the group by the sources cited.
MITRE says the group has conducted operations since at least 2012.[1]
ENISA and CERT-EU say the group was first observed in 2017.[8]
ENISA and CERT-EU say the group used public documents of EU bodies as lures, and that CERT-EU saw more campaigns from late 2021.[8]
CERT-EU brief of 3 November 2022 reports it.[10]
CERT-EU reports activity from January 2023 across Europe and parts of Asia-Pacific.[11]
CERT-EU assesses at least 15 waves in 2023.[9]
MITRE campaign C0047, run by the group against entities in East and Southeast Asia.[2]
The FBI affidavit says at least 45,000 US IP addresses have contacted the server since then.[4]
CERT-EU reports suspected targeting of the Ministry of Defence and Foreign Affairs.[12]
Listed as targets in the FBI affidavit.[4]
Justice obtained the first warrant in August 2024; the last expired on 3 January 2025.[3]
Justice says PlugX was deleted from approximately 4,258 US computers and networks.[3]
CERT-EU brief of 1 July 2026 calls it a possible campaign, not confirmed.[14]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 15 February 2023 | ENISA and CERT-EU | Joint publication JP-23-01Named Mustang Panda among six China-linked groups active against business and governments in the EU and gave recommendations.[8] |
| February 2024 | CERT-EU | Yearly threat reportReported the group as one of the two most active spearphishing actors against EU targets in 2023.[9] |
| 14 May 2024 | CISA, FBI, DHS I&A and partner agencies in Canada, Estonia, Finland, Japan and the UK | Joint guidanceNamed Mustang Panda among groups known to target civil society and listed ten priority measures; the Canadian Cyber Centre and Japan's National Police Agency published it too.[5, 6, 7] |
| August 2024 | US Department of Justice and FBI | Court-authorized operationObtained the first of nine warrants in the Eastern District of Pennsylvania to delete PlugX from US computers.[3] |
| 3 January 2025 | US Department of Justice and FBI | End of US part of operationThe last of the nine warrants expired.[3] |
| 14 January 2025 | US Department of Justice and FBI | Announcement and unsealingAnnounced the PlugX removal with international partners including French law enforcement, from approximately 4,258 US computers and networks; the affidavit was unsealed. No charges or sanctions were announced.[3, 4] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Attachment T1566.001
MITRE says the group used spearphishing attachments to deliver initial payloads, and the CISA-led guidance names spearphishing as its preferred way in.[1, 5]
Phishing: Spearphishing Link T1566.002
MITRE says the group sent emails with links to a malicious archive hosted on Google or Dropbox.[1]
PlugX Remote access tool
MITRE says it is used by multiple threat groups; Justice says the PRC government paid the group to develop one specific version.[3, 15]
TONESHELL Backdoor
MITRE says Chinese-affiliated actors identified as Mustang Panda have used it.[16]
PUBLOAD Stager
MITRE says China-affiliated actors identified as Mustang Panda have used this stager malware.[17]
RCSession Backdoor
MITRE says it has been in use since at least 2018 by Mustang Panda and by Threat Group-3390.[18]
BOOKWORM Modular trojan
MITRE says Mustang Panda uses it and that it was first observed in 2015.[19]
ShadowPad Malware
Listed by MITRE as software used by the group.[1]
PoisonIvy Malware
Listed by MITRE as software used by the group; also in the example tools in ENISA and CERT-EU's list.[1, 8]
Cobalt Strike Attack tool
Listed by MITRE as software used by the group; also in the example tools in ENISA and CERT-EU's list.[1, 8]
Mimikatz Credential dumping tool
MITRE says the group harvested credentials from the memory of the LSASS process with it.[1]
Impacket Network tool
MITRE says the group used it with other tools to run WinRAR for archiving files.[1]
AdFind Directory query tool
MITRE says the group used it to enumerate domain groups, users and computers.[1]
China Chopper Web shell
Listed by MITRE as software used by the group.[1]
Disable Autorun if it is not needed and limit the use of USB devices and removable media on the network.
Counters T1091
Scan systems for unauthorized archive utilities, and write and rehearse incident response and recovery plans.
Counters T1560.001
Watch for look-alike domains and phishing pages aimed at your staff, since MITRE says the group sets up its own domains before operations.
Follow what governments and MITRE report about this group and compare its listed techniques with your own controls.
Help the diplomats, researchers and senior staff who get targeted emails to spot lures built around their work.
MITRE ATT&CK describes it as a China-based cyber espionage threat actor operating since at least 2012. The US Department of Justice, citing court documents, says it is a group sponsored by the PRC. CERT-EU calls it China-linked.
MITRE lists a campaign from July 2023 to December 2024. CERT-EU's brief of 1 July 2026 reports a possible phishing campaign in June 2026, which it describes as possible, not confirmed.
MITRE lists government, diplomatic and non-governmental organizations, think tanks, religious institutions and research bodies in the US, Europe and Asia. The Justice Department adds Chinese dissident groups, and the CISA-led guidance adds activist groups.
MITRE and the CISA-led guidance describe phishing emails with decoy documents, archives or links, then a signed program that loads a malicious DLL. ENISA and CERT-EU also list watering hole attacks and infected USB drives.
In part. Justice says a court-authorized operation deleted a version of PlugX from approximately 4,258 US computers and networks. The last warrant expired on 3 January 2025 and the FBI says it continues to investigate.
Keep software updated and use phishing-resistant multifactor authentication, as the joint guidance lists first. Then train staff to spot decoy documents and restrict USB use.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.