Mustang PandaG0129 state-contractor

About this actor

[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. [Mustang Panda](https://attack.mitre.org/groups/G0129) has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. (Citation: BlackBerry MUSTANG PANDA October 2022)(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: DOJ Affidavit Search and Seizure PlugX December 2024)(Citation: EclecticIQ Mustang Panda PlugX)(Citation: ATTACKIQ MUSTANG PANDA TONESHELL March 2023)(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Palo Alto Networks, Unit 42)(Citation: Sophos PlugX September 2022)(Citation: Sophos Mustang Panda PLUGX)(Citation: Zscaler)

Source: MITRE ATT&CK

Activity timeline

• 2026 — 2 CVE published

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

• SolarWinds Compromise 1 shared CVEs
• APT38 1 shared CVEs
• Tonto Team 1 shared CVEs
• Ember Bear 1 shared CVEs
• GOLD SOUTHFIELD 1 shared CVEs
• Aquatic Panda 1 shared CVEs
• APT28 1 shared CVEs
• Sandworm Team 1 shared CVEs
• Ajax Security Team 1 shared CVEs
• FIN7 1 shared CVEs

Similar actors