Activity timeline
Mustang Panda appears in 14 tracked threats between and ; the busiest month was 2026-03 with 4 reports.
ATT&CK techniques observed
- T1140 Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion)observed in 11 of 14 tracked threats
- T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 10 of 14 tracked threats
- T1082 System Information Discovery — Discoveryobserved in 10 of 14 tracked threats
- T1105 Ingress Tool Transfer — Command and Controlobserved in 10 of 14 tracked threats
- T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 8 of 14 tracked threats
- T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 8 of 14 tracked threats
- T1071 Application Layer Protocol — Command and Controlobserved in 8 of 14 tracked threats
- T1106 Native API — Executionobserved in 8 of 14 tracked threats
- T1574 Hijack Execution Flow — Stealth (formerly Defense Evasion)observed in 8 of 14 tracked threats
- T1005 Data from Local System — Collectionobserved in 7 of 14 tracked threats
- T1059 Command and Scripting Interpreter — Executionobserved in 7 of 14 tracked threats
- T1547 Boot or Logon Autostart Execution — Persistenceobserved in 7 of 14 tracked threats
- T1573 Encrypted Channel — Command and Controlobserved in 7 of 14 tracked threats
- T1083 File and Directory Discovery — Discoveryobserved in 6 of 14 tracked threats
- T1204 User Execution — Executionobserved in 6 of 14 tracked threats
Tracked threats
- Mustang Panda Targets India's Government and Energy Sectors with SHARDLOADER, MINIRECON, and ZOHOMURKHIGH
- HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with Kernel-Level Windows Rootkit (msagent.sys)HIGH
- QuickFox Supply Chain Attack Deploys FDMTP Implant via Trojanized VPN Proxy/Game AcceleratorMEDIUM
- SolidPDFCreator: Mustang Panda Stage-1 Backdoor Targeting India via DLL Side-LoadingHIGH
- ASEC June 2026 APT Trend Report: Nation-State Actors Pivot to Cloud/OAuth Abuse, MaaS, and Supply-Chain CompromiseMEDIUM
- AhnLab ASEC April 2026 APT Group Trend Report: State-Sponsored Espionage Campaigns (CVE-2026-32202, CVE-2025-20333/20362, CVE-2021-26855)HIGH
- Mustang Panda PlugX RAT — Multi-Stage Fake Browser Update Chain via G DATA AntiVirus DLL Sideloading (BlueCyber)HIGH
- Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets Indian Banking (HDFC) and South Korean Policy CirclesHIGH
- Fake Claude AI Download Site Delivers Trojanized Installer Deploying PlugX RAT via G DATA DLL SideloadingHIGH
- China-Aligned Espionage Clusters (Stately Taurus, CL-STA-1048, CL-STA-1049) Deploy USBFect, Masol RAT, FluffyGh0st and Custom Loaders Against Southeast Asian GovernmentHIGH
- Mustang Panda Deploys PlugX RAT via Multi-Stage CHM Sideloading Campaign Targeting Persian Gulf Region (March 2026)HIGH
- HoneyMyte (Mustang Panda) CoolClient Backdoor Update with Browser Data Stealers Targeting Southeast Asian Government and MilitaryHIGH
- Mustang Panda LOTUSLITE Backdoor & StealC Campaigns Exploiting Middle East Conflict ThemesHIGH
- PlugX Meeting Invitation Campaign — China-Nexus MSBuild LOLBIN + GDATA DLL Sideloading, RC4 Encrypted C2, STATICPLUGIN Variant (Mustang Panda / UNC6384)HIGH