Mustang Panda has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. Mustang Panda has used FakeTLS to communicate with its C2 servers.14
group
Mustang Panda G0129
- Created
- 12 April 2021
- Last modified
- 31 July 2026
- Aliases
- Mustang Panda · TA416 · RedDelta · BRONZE PRESIDENT · STATELY TAURUS · FIREANT · CAMARO DRAGON · EARTH PRETA · HIVE0154 · TWILL TYPHOON · TANTALUM · LUMINOUS MOTH · UNC6384 · TEMP.Hex · Red Lich · ClumsyToad
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]
85
TechniquesTop 2%
14
TacticsTop 6%
23
Tools & malwareTop 5%
1
Campaignunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G0129
Mustang Panda utilized “Hdump” to dump credentials from memory.15
Mustang Panda has harvested credentials from memory of lssas.exe with Mimikatz.16
Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.1718
Mustang Panda has leveraged Mimikatz DCSync feature to obtain user credentials.19
Mustang Panda has used ipconfig and arp to determine network configuration information.20 Mustang Panda has also utilized SharpNBTScan to scan the victim environment.21
Standing G0129
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques85Top 2%
98th percentile · 98% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
Tactics14Top 6%
94th percentile · 94% of 176 ATT&CK groups have this many tactics spanned or fewer.
Tools & malware23Top 5%
95th percentile · 95% of 176 ATT&CK groups have this many tools and malware or fewer.
Campaign189% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique13med38th pct
38th percentile · 62% of 176 ATT&CK groups have more detection rules per technique.
Tests / technique2med
Detection coverage G0129
1945 distinct rules cover the 85 techniques recorded for this group. The 2372 technique-to-rule mappings resolve to 1945 distinct rules, because one rule can cover several techniques. 1386 Sigma · 559 Splunk.
69 covered by at least one rule16 with no coverage1945 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org