Mustang Panda
Attribution profile
- Type
- Nation State
- Location
- China
- Known incidents
- 13 incidents
- Sources
- 39 sources
- First seen
- 2019-12-07
- Last seen
- 2022-05-03
- Updated
- 2026-10-07 02:32
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Mustang Panda (also tracked as Bronze President and HoneyMyte) is a China‑linked threat actor engaged in cyber‑espionage. The group primarily targets government officials, religious organizations and diplomatic entities in regions such as Russia, Myanmar, Hong Kong and Europe, seeking intelligence gain through stealthy intrusion. Its typical tactics involve spear‑phishing emails with decoy documents—such as EU sanction notices, Vatican communications or Catholic news—containing malicious executables disguised as PDFs. These files employ DLL search order hijacking or DLL side‑loading, often abusing a legitimate signed file from Global Graphics Software Ltd to silently load the PlugX remote access trojan. The actor reuses infrastructure, including staging servers and domains like zyber‑i[.]com, and has been observed communicating with command‑and‑control servers (e.g., 95.217.1[.]81). Attribution to Chinese state‑backed operators is supported by Secureworks, Mandiant and other researchers, who link the malware, tooling and reused infrastructure to Mustang Panda. Representative operations include a 2022 phishing campaign against Russian officials using EU sanction lures, a 2021 compromise of the Myanmar president’s website to distribute a malicious font package, and a 2020 spear‑phishing effort targeting the Hong Kong Catholic Diocese with Vatican‑themed decoys.
Incidents
Attributed incidents are available to members.
13 incidentsSources
Sources available to members: 39 sources.