AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0129 · 45 ATT&CK techniques · 0 correlated reports

Mustang Panda

Aliases: TA416, RedDelta, BRONZE PRESIDENT

Mustang Panda is a China-based cyber espionage threat actor that was first observed in 2017 but may have been conducting operations since at least 2014. Mustang Panda has targeted government entities, nonprofits, religious, and other non-governmental organizations in the U.S., Europe, Mongolia, Myanmar, Pakistan, and Vietnam, among others.

Open interactive actor investigation

ATT&CK techniques

T1016
System Network Configuration Discovery T1608.001
Upload Malware T1047
Windows Management Instrumentation T1573.001
Symmetric Cryptography T1204.001
Malicious Link T1049
System Network Connections Discovery T1059.005
Visual Basic T1053.005
Scheduled Task T1598.003
Spearphishing Link T1564.001
Hidden Files and Directories T1218.005
Mshta T1585.002
Email Accounts T1219
Remote Access Software T1218.004
InstallUtil T1560.001
Archive via Utility T1071.001
Web Protocols T1566.002
Spearphishing Link T1091
Replication Through Removable Media T1059.003
Windows Command Shell T1052.001
Exfiltration over USB T1560.003
Archive via Custom Method T1070.004
File Deletion T1057
Process Discovery T1082
System Information Discovery T1203
Exploitation for Client Execution T1608
Stage Capabilities T1566.001
Spearphishing Attachment T1083
File and Directory Discovery T1518
Software Discovery T1583.001
Domains T1574.002
DLL Side-Loading T1546.003
Windows Management Instrumentation Event Subscription T1003.003
NTDS T1027
Obfuscated Files or Information T1547.001
Registry Run Keys / Startup Folder T1119
Automated Collection T1105
Ingress Tool Transfer T1074.001
Local Data Staging T1059.001
PowerShell T1027.001
Binary Padding T1204.002
Malicious File T1036.007
Double File Extension T1102
Web Service T1036.005
Match Legitimate Name or Location T1036
Masquerading

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research