MUSTANG PANDA
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes. In April 2017, CrowdStrike Falcon Intelligence observed a previously unattributed actor group with a Chinese nexus targeting a U.S.-based think tank. Further analysis revealed a wider campaign with unique tactics, techniques, and procedures (TTPs). This adversary targets non-governmental organizations (NGOs) in general, but uses Mongolian language decoys and themes, suggesting this actor has a specific focus on gathering intelligence on Mongolia. These campaigns involve the use of shared malware like Poison Ivy or PlugX. Recently, Falcon Intelligence observed new activity from MUSTANG PANDA, using a unique infection chain to target likely Mongolia-based victims. This newly observed activity uses a series of redirections and fileless, malicious implementations of legitimate tools to gain access to the targeted systems. Additionally, MUSTANG PANDA actors reused previously-observed legitimate domains to host files.
Source-reported aliases: BRONZE PRESIDENT, HoneyMyte, Red Lich, TEMP.HEX, BASIN, Earth Preta, TA416, Stately Taurus, LuminousMoth, Polaris, TANTALUM, Twill Typhoon, BASIN CASTLE, ITG27, Hive0154, Mustang Panda, UNK_SteadySplit. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
United States of America · 
Germany
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.cfr.org/interactive/cyber-operations/mustang-panda
https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
https://www.secureworks.com/research/threat-profiles/bronze-president
https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf
https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf
https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf
https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html
https://unit42.paloaltonetworks.com/stately-taurus-targets-philippines-government-cyberespionage/
https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW
https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_2_LT4.pdf
https://thecyberwire.com/podcasts/microsoft-threat-intelligence/4/notes