# Mustang Panda

> As of 2026-10-22, Mustang Panda is a China-nexus threat actor tracked by Threadlinqs Intelligence across 15 threats spanning apt, malware, supply chain. Also known as Twill Typhoon, HoneyMyte, BRONZE PRESIDENT, CAMARO DRAGON. ATT&CK coverage spans 138 techniques across 15 tactics in 15 of 15 tracked threats. Most-observed techniques: T1140 (Deobfuscate/Decode Files or Information), T1027 (Obfuscated Files or Information), T1082 (System Information Discovery).

- **Nation:** China
- **Tracked threats:** 15
- **Categories:** APT, MALWARE, SUPPLY_CHAIN, CAMPAIGN
- **Also known as:** Twill Typhoon, HoneyMyte, BRONZE PRESIDENT, CAMARO DRAGON, ClumsyToad, EARTH PRETA, FIREANT, HIVE0154, LUMINOUS MOTH, Red Lich, RedDelta, STATELY TAURUS
- **As of:** 2026-10-22

## ATT&CK techniques observed

138 techniques observed across 15 of 15 tracked threats. Tactics: Stealth (formerly Defense Evasion) (27), Command and Control (16), Execution (13), Persistence (13), Resource Development (13), Initial Access (11).

- [T1140](https://intel.threadlinqs.com/technique/T1140) Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion) — observed in 11 of 15 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 10 of 15 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 10 of 15 tracked threats
- [T1105](https://intel.threadlinqs.com/technique/T1105) Ingress Tool Transfer — Command and Control — observed in 10 of 15 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 8 of 15 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 8 of 15 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 8 of 15 tracked threats
- [T1106](https://intel.threadlinqs.com/technique/T1106) Native API — Execution — observed in 8 of 15 tracked threats
- [T1574](https://intel.threadlinqs.com/technique/T1574) Hijack Execution Flow — Stealth (formerly Defense Evasion) — observed in 8 of 15 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 7 of 15 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 7 of 15 tracked threats
- [T1547](https://intel.threadlinqs.com/technique/T1547) Boot or Logon Autostart Execution — Persistence — observed in 7 of 15 tracked threats
- [T1573](https://intel.threadlinqs.com/technique/T1573) Encrypted Channel — Command and Control — observed in 7 of 15 tracked threats
- [T1083](https://intel.threadlinqs.com/technique/T1083) File and Directory Discovery — Discovery — observed in 6 of 15 tracked threats
- [T1204](https://intel.threadlinqs.com/technique/T1204) User Execution — Execution — observed in 6 of 15 tracked threats

## Tracked threats

- [Fire Ant (China-nexus, UNC3886 overlap) compromises Cisco IOS XR routers, TACACS+ servers and Linux management hosts with BridgeAgent and TacTap](https://intel.threadlinqs.com/threat/TL-2026-4123) — HIGH
- [Mustang Panda Targets India's Government and Energy Sectors with SHARDLOADER, MINIRECON, and ZOHOMURK](https://intel.threadlinqs.com/threat/TL-2026-2293) — HIGH
- [HoneyMyte (Mustang Panda) Upgrades CoolClient Backdoor with Kernel-Level Windows Rootkit (msagent.sys)](https://intel.threadlinqs.com/threat/TL-2026-2013) — HIGH
- [QuickFox Supply Chain Attack Deploys FDMTP Implant via Trojanized VPN Proxy/Game Accelerator](https://intel.threadlinqs.com/threat/TL-2026-1864) — MEDIUM
- [SolidPDFCreator: Mustang Panda Stage-1 Backdoor Targeting India via DLL Side-Loading](https://intel.threadlinqs.com/threat/TL-2026-1292) — HIGH
- [ASEC June 2026 APT Trend Report: Nation-State Actors Pivot to Cloud/OAuth Abuse, MaaS, and Supply-Chain Compromise](https://intel.threadlinqs.com/threat/TL-2026-1287) — MEDIUM
- [AhnLab ASEC April 2026 APT Group Trend Report: State-Sponsored Espionage Campaigns (CVE-2026-32202, CVE-2025-20333/20362, CVE-2021-26855)](https://intel.threadlinqs.com/threat/TL-2026-0745) — HIGH
- [Mustang Panda PlugX RAT — Multi-Stage Fake Browser Update Chain via G DATA AntiVirus DLL Sideloading (BlueCyber)](https://intel.threadlinqs.com/threat/TL-2026-0658) — HIGH
- [Mustang Panda LOTUSLITE v1.1 Espionage Campaign Targets Indian Banking (HDFC) and South Korean Policy Circles](https://intel.threadlinqs.com/threat/TL-2026-0430) — HIGH
- [Fake Claude AI Download Site Delivers Trojanized Installer Deploying PlugX RAT via G DATA DLL Sideloading](https://intel.threadlinqs.com/threat/TL-2026-0349) — HIGH
- [China-Aligned Espionage Clusters (Stately Taurus, CL-STA-1048, CL-STA-1049) Deploy USBFect, Masol RAT, FluffyGh0st and Custom Loaders Against Southeast Asian Government](https://intel.threadlinqs.com/threat/TL-2026-0289) — HIGH
- [Mustang Panda Deploys PlugX RAT via Multi-Stage CHM Sideloading Campaign Targeting Persian Gulf Region (March 2026)](https://intel.threadlinqs.com/threat/TL-2026-0219) — HIGH
- [HoneyMyte (Mustang Panda) CoolClient Backdoor Update with Browser Data Stealers Targeting Southeast Asian Government and Military](https://intel.threadlinqs.com/threat/TL-2026-0197) — HIGH
- [Mustang Panda LOTUSLITE Backdoor & StealC Campaigns Exploiting Middle East Conflict Themes](https://intel.threadlinqs.com/threat/TL-2026-0184) — HIGH
- [PlugX Meeting Invitation Campaign — China-Nexus MSBuild LOLBIN + GDATA DLL Sideloading, RC4 Encrypted C2, STATICPLUGIN Variant (Mustang Panda / UNC6384)](https://intel.threadlinqs.com/threat/TL-2026-0153) — HIGH

## Related CVEs

5 CVEs referenced by tracked Mustang Panda activity.

- [CVE-2026-32202](https://intel.threadlinqs.com/cve/CVE-2026-32202)
- [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509)
- [CVE-2025-20362](https://intel.threadlinqs.com/cve/CVE-2025-20362)
- [CVE-2025-20333](https://intel.threadlinqs.com/cve/CVE-2025-20333)
- [CVE-2021-26855](https://intel.threadlinqs.com/cve/CVE-2021-26855)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Mustang%20Panda