EXPLORE
← Back to Actors

Mustang Panda

Mustang PandaTA416RedDeltaBRONZE PRESIDENTSTATELY TAURUSFIREANTCAMARO DRAGONEARTH PRETAHIVE0154TWILL TYPHOONTANTALUMLUMINOUS MOTHUNC6384TEMP.HexRed LichClumsyToad

[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. [Mustang Panda](https://attack.mitre.org/groups/G0129) has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myan...

85
Techniques
74
Covered
11
Gaps
87%
Coverage
Coverage74/85

COVERED (74)

T1001.003Protocol or Service Impersonation2 det.T1003OS Credential Dumping114 det.T1003.001LSASS Memory111 det.T1003.003NTDS36 det.T1003.006DCSync16 det.T1016System Network Configuration Discovery41 det.T1018Remote System Discovery52 det.T1027Obfuscated Files or Information707 det.T1027.012LNK Icon Smuggling1 det.T1036.005Match Legitimate Resource Name or Location49 det.T1036.007Double File Extension4 det.T1036.008Masquerade File Type5 det.T1041Exfiltration Over C2 Channel32 det.T1046Network Service Discovery53 det.T1047Windows Management Instrumentation88 det.T1048.003Exfiltration Over Unencrypted Non-C2 Protocol23 det.T1049System Network Connections Discovery23 det.T1052.001Exfiltration over USB4 det.T1053.005Scheduled Task100 det.T1057Process Discovery24 det.T1059Command and Scripting Interpreter552 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.005Visual Basic71 det.T1059.007JavaScript64 det.T1069.002Domain Groups45 det.T1070Indicator Removal68 det.T1070.004File Deletion46 det.T1070.006Timestomp10 det.T1071.001Web Protocols83 det.T1072Software Deployment Tools13 det.T1074.001Local Data Staging10 det.T1082System Information Discovery91 det.T1083File and Directory Discovery49 det.T1087.002Domain Account58 det.T1091Replication Through Removable Media8 det.T1095Non-Application Layer Protocol26 det.T1102Web Service36 det.T1105Ingress Tool Transfer199 det.T1106Native API30 det.T1119Automated Collection12 det.T1129Shared Modules14 det.T1140Deobfuscate/Decode Files or Information59 det.T1203Exploitation for Client Execution81 det.T1204.001Malicious Link11 det.T1204.002Malicious File468 det.T1205Traffic Signaling1 det.T1218.004InstallUtil15 det.T1218.005Mshta51 det.T1219.002Remote Desktop Software57 det.T1505.003Web Shell70 det.T1518Software Discovery17 det.T1546.003Windows Management Instrumentation Event Subscription18 det.T1547.001Registry Run Keys / Startup Folder53 det.T1553.002Code Signing4 det.T1557Adversary-in-the-Middle40 det.T1560.001Archive via Utility27 det.T1564.001Hidden Files and Directories26 det.T1566.001Spearphishing Attachment1144 det.T1566.002Spearphishing Link1194 det.T1567.002Exfiltration to Cloud Storage33 det.T1572Protocol Tunneling62 det.T1574.001DLL111 det.T1574.005Executable Installer File Permissions Weakness2 det.T1583.001Domains69 det.T1583.006Web Services1 det.T1587.001Malware10 det.T1588.002Tool13 det.T1588.004Digital Certificates1 det.T1598.003Spearphishing Link353 det.T1608Stage Capabilities11 det.T1608.001Upload Malware3 det.T1622Debugger Evasion1 det.T1654Log Enumeration1 det.