# Mustang Panda

# Adversary Overview

Mustang Panda is a China-based cyber espionage group that has been active since at least 2017, with some evidence indicating they have been operating since 2011. The FBI assesses that Mustang Panda takes payment from the Chinese government in exchange for providing malware, including PlugX, and offensive services. Historically, Mustang Panda’s campaigns have targeted organizations of strategic interest to the Chinese government, namely government entities, nonprofits, and NGOs in South and Southeast Asia, Europe, and the US. However, the group has also evolved to expand its targeting set to include government entities, diplomatic missions, telecom providers, and private sector organizations. The group is one of the most consistently active and adaptive state-sponsored APTs operating out of China.

# Key Adversary Report References

Source ID	Report Links
1	Spearphishing TrendMicro
2	Earth Preta Updated Stealthy Strategies
3	Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks
4	JPCERT
5	Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit
6	UNIT42 Taurus Attack
7	UNIT42 Taurus VSCode Abuse
8	Hitching a ride with Mustang Panda