Mustang Panda

Threat actor

Attributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.

Names and who uses them

Mustang PandaOur name
TEMP.HexGoogle
UNC6384Google
LUMINOUS MOTHMicrosoft
TANTALUMMicrosoft
TWILL TYPHOONMicrosoft
CAMARO DRAGONMITRE ATT&CK
ClumsyToadMITRE ATT&CK
EARTH PRETAMITRE ATT&CK
HIVE0154MITRE ATT&CK
STATELY TAURUSPalo Alto Networks
TA416Proofpoint
Red LichPwC
RedDeltaRecorded Future
BRONZE PRESIDENTSecureworks
FIREANTSymantec

Targets

Sectors: Government, NGOs and think tanks, Diplomatic

Regions: Europe, United States, Vietnam

Source: MITRE ATT&CK

Known techniques

T1001.003Protocol or Service Impersonation
T1003OS Credential Dumping
T1003.001LSASS Memory
T1003.003NTDS
T1003.006DCSync
T1016System Network Configuration Discovery
T1018Remote System Discovery
T1027Obfuscated Files or Information
T1027.007Dynamic API Resolution
T1027.012LNK Icon Smuggling
T1027.016Junk Code Insertion
T1036.005Match Legitimate Resource Name or Location
T1036.007Double File Extension
T1036.008Masquerade File Type
T1041Exfiltration Over C2 Channel
T1046Network Service Discovery
T1047Windows Management Instrumentation
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1049System Network Connections Discovery
T1052.001Exfiltration over USB
T1053.005Scheduled Task
T1057Process Discovery
T1059Command and Scripting Interpreter
T1059.001PowerShell
T1059.003Windows Command Shell
T1059.005Visual Basic
T1059.007JavaScript
T1069.002Domain Groups
T1070Indicator Removal
T1070.004File Deletion
T1070.006Timestomp
T1071.001Web Protocols
T1072Software Deployment Tools
T1074.001Local Data Staging
T1082System Information Discovery
T1083File and Directory Discovery
T1087.002Domain Account
T1091Replication Through Removable Media
T1095Non-Application Layer Protocol
T1102Web Service

Source: MITRE ATT&CK

Malware and tools used

Source: MITRE ATT&CK

Recent news

No stories yet.