This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes. In April 2017, CrowdStrike Falcon Intelligence observed a previously unattributed actor group with a Chinese nexus targeting a U.S.-based think tank. Further analysis revealed a wider campaign with unique tactics, techniques, and procedures (TTPs). This adversary targets non-governmental organizations (NGOs) in general, but uses Mongolian language decoys and themes, suggesting this actor has a specific focus on gathering intelligence on Mongolia. These campaigns involve the use of shared malware like Poison Ivy or PlugX. Recently, Falcon Intelligence observed new activity from MUSTANG PANDA, using a unique infection chain to target likely Mongolia-based victims. This newly observed activity uses a series of redirections and fileless, malicious implementations of legitimate tools to gain access to the targeted systems. Additionally, MUSTANG PANDA actors reused previously-observed legitimate domains to host files.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Microsoft | Twill Typhoon |
| Secureworks | Bronze President |
| OSINT | HoneyMyte |
| OSINT | Red Lich |
| OSINT | TEMP.HEX |
| OSINT | BASIN |
| OSINT | Earth Preta |
| OSINT | TA416 |
| OSINT | Stately Taurus |
| OSINT | LuminousMoth |
| OSINT | Polaris |
| OSINT | TANTALUM |
| OSINT | BASIN CASTLE |
| OSINT | ITG27 |
| OSINT | Hive0154 |
| OSINT | Mustang Panda |
| OSINT | UNK_SteadySplit |
| OSINT | RedDelta |
| OSINT | FIREANT |
| OSINT | CAMARO DRAGON |
| OSINT | LUMINOUS MOTH |
| OSINT | UNC6384 |
| OSINT | ClumsyToad |
Sectors: Civil society
Victim countries: United States, Germany
Top 62 by how many reports mention them.
Every report in the Global Intel Library that names MUSTANG PANDA, newest first. Open any report to see the full analysis with provenance.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to MUSTANG PANDA. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.