Mustang Panda

Overview

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.

Targets

Civil society

Regions

Germany · United States

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 18 attributed custom malware families

TTPs — 85 techniques across 14 tactics

Tools & malware (23)

CANONSTAGER · STATICPLUGIN · ShadowPad · TONESHELL · Cobalt Strike · HIUPAN · Impacket · SplatCloak · PAKLOG · Wevtutil · AdFind · CLAIMLOADER · Mimikatz · PUBLOAD · StarProxy · CorKLOG · RCSession · NBTscan · PoisonIvy · SplatDropper · BOOKWORM · China Chopper · PlugX

Reporting (3)

• Introducing the 2026 Cloudflare Threat Report — Cloudflare
• How Microsoft names threat actors — Microsoft
• Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats — Patrick Whitsell