Mofang

Overview

Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.

Naming & attribution

Mofang is tracked under 1 names across the industry. It uses 6 documented ATT&CK techniques — more than 17% of the 174 groups tracked here.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Elderwood China — 5 shared techniques (50% overlap)
• Transparent Tribe Pakistan — 5 shared techniques (33% overlap)
• Machete — 4 shared techniques (31% overlap)
• Molerats — 5 shared techniques (29% overlap)
• FIN4 — 4 shared techniques (29% overlap)
• BlackTech China — 4 shared techniques (25% overlap)

Targets

Government · Private sector

Regions

Canada · Germany · India · Myanmar · Singapore · South Korea · United States

TTPs — 6 techniques across 3 tactics

Tools & malware (2)

ShimRatReporter · ShimRat

Reporting (1)

• Mofang: A politically motivated information stealing adversary — Yonathan Klijnsma