ChinaAssessedChina-basedEspionageActive 2012 – 2026Mustang Panda
Also known asRedDelta · Bronze President · Earth Preta · Camaro Dragon · HoneyMyte · Temp.Hex · Stately Taurus · Red Lich · Twill Typhoon · Hive0154 · TANTALUM · LUMINOUS MOTH · ClumsyToad
Summary
China-based group (MITRE; no service publicly named) targeting SE Asia govts, Vatican, and NGOs. Trojanises legitimate apps (NVIDIA driver, Interpol notices) as PlugX delivery. Targeted EU diplomatic entities pre-Ukraine invasion 2022.
Attribution
AssessedResearch assessment: China-based
No service publicly named
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
Sources
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
China-based cyber espionage actor
Campaigns 5
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| India government and hydropower — SHARDLOADER, MINIRECON and ZOHOMURK (Zoho WorkDrive C2) | 2026-05 – 2026-06 | India | Government, Energy | Acronis TRU (2026-06-28) |
| UNC6384 European diplomats — ZDI-CAN-25373 LNK lures delivering PlugXASSESSED | 2025-09 – 2025-10 | Hungary, Belgium, Europe | Diplomatic | Arctic Wolf Labs (2025-10-30) — UNC6384, 'believed to have associations' with Mustang Panda |
| UNC6384 captive-portal AitM against SE Asian diplomats — STATICPLUGIN → CANONSTAGER → SOGU.SECASSESSED | 2025-03 | Southeast Asia, Global | Diplomatic, Government | Google Threat Intelligence Group (2025-08-25) — UNC6384, 'believed to be associated' with TEMP.Hex/Mustang Panda |
| Taiwan critical-infrastructure targeting (NSB 2025 annual assessment) | 2025 | Taiwan | Energy, Healthcare, Communications, Government, Technology | Taiwan National Security Bureau, 'Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025' (2026-01-04) |
| Operation HIUPAN — USB Spread | 2024 | Myanmar, Philippines, Vietnam, Singapore, Cambodia, Taiwan | Government | Trend Micro (2024-09-09) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 13
Malware and tools 18
| Name | Description | Platform |
|---|---|---|
| PlugX/Korplug | Modular RAT | Windows |
| Cobalt Strike | Post-exploitation | Windows/Linux |
| TONESHELL | Backdoor | Windows |
| PUBLOAD | Loader | Windows |
| PUBSHELL | Reverse Shell | Windows |
| FDMTP | Custom Backdoor | Windows |
| HIUPAN | USB Worm | Windows |
| SOGU.SEC | Backdoor (PlugX/SOGU variant) | Windows |
| StarProxy | Lateral-movement proxy (FakeTLS) | Windows |
| SplatCloak | Malware | Windows |
| PAKLOG | Malware | Windows |
| CLAIMLOADER | Malware | Windows |
| CorKLOG | Malware | Windows |
| SplatDropper | Malware | Windows |
| BOOKWORM | Malware | Windows |
| ZOHOMURK | Implant using Zoho WorkDrive for C2 and exfiltration | Windows |
| MINIRECON | TONESHELL-derived implant (WebSocket C2) | Windows |
| SHARDLOADER | DLL loader | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2017-0199 | 7.8 | Microsoft Office/WordPad — RTF/HTA remote code execution (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Zoho WorkDrive as C2 for ZOHOMURK; MINIRECON over WebSockets with self-signed certs (Acronis, 2026)
- New C2 bought in the same /24 and hosting provider as earlier Pubload C2 (Acronis, 2026)
- OneDrive through the Graph API as an exfiltration channel, using refresh tokens (Trend Micro, 2024)
Reporting and advisories 8
- ESET
Mustang Panda's Hodur: Old tricks, new Korplug variant (Mar 2022) - FBI
Operation 'Iron Bridge' — Mustang Panda PlugX Disruption (Jan 2025) - Trend Micro
Operation HIUPAN — USB Spread - Google Threat Intelligence Group
UNC6384 captive-portal AitM against SE Asian diplomats — STATICPLUGIN → CANONSTAGER → SOGU.SEC - Arctic Wolf Labs
UNC6384 European diplomats — ZDI-CAN-25373 LNK lures delivering PlugX - Taiwan National Security Bureau
Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025 (4 Jan 2026) - Acronis TRU
India government and hydropower — SHARDLOADER, MINIRECON and ZOHOMURK (Zoho WorkDrive C2) - MITRE ATT&CK
Mustang Panda (G0129) group profile