Mofang

G0103 China Espionage MITRE ATT&CK →

Overview

Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.

Naming & attribution

It uses 6 documented ATT&CK techniques — more than 17% of the 174 groups tracked here.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

Elderwood China — 5 shared techniques (50% overlap)
Transparent Tribe Pakistan — 5 shared techniques (33% overlap)
Machete — 4 shared techniques (31% overlap)
Molerats — 5 shared techniques (29% overlap)
FIN4 — 4 shared techniques (29% overlap)
BlackTech China — 4 shared techniques (25% overlap)

Malware families with tracked indicators

One family attributed to Mofang, with 3 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-09-26). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

Shim RAT 3 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Targets

Government · Private sector

Regions

Canada · Germany · India · Myanmar · Singapore · South Korea · United States

TTPs — 6 techniques across 3 tactics

Tools & malware (2)

ShimRatReporter · ShimRat

Reporting (1)

Mofang: A politically motivated information stealing adversary — Yonathan Klijnsma