Threat actorChinaTracked since 2026-10

Mustang Panda - G0129

Also known as:Fire Ant

As of 2026-10-22, Mustang Panda - G0129 is a China-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning apt. Also known as Fire Ant.

Tracked threats: 11 high
First seen: 2026-102026-10-22
Last seen: 2026-102026-10-22
ATT&CK techniques: —No mapped techniques yet
Related CVEs: 0None referenced
Attribution: ChinaNation or origin

Nation: China · 1 tracked threat(s) · Categories: APT

Activity timeline

Mustang Panda - G0129 appears in 1 tracked threat between 2026-10-22 and 2026-10-22.

Tracked threats

Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco IOS XR routers, TACACS+ servers and Linux management hosts with BridgeAgent and TacTapHIGH2026-10-22