ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Threat actors

G0129threat actor

Mustang Panda

a.k.a. TA416, RedDelta, BRONZE PRESIDENT, STATELY TAURUS, FIREANT, CAMARO DRAGON, EARTH PRETA, HIVE0154, TWILL TYPHOON, TANTALUM, LUMINOUS MOTH, UNC6384, TEMP.Hex, Red Lich, ClumsyToad

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.

MITRE ATT&CK ↗

Linked entities · 24

usesT1016System Network Configuration Disc…usesS1237CANONSTAGER usesT1608.001Upload Malware usesT1583.006Web Services usesT1047Windows Management Instrumentation usesT1573.001Symmetric Cryptography usesT1593Search Open Websites/Domains usesS1238STATICPLUGIN usesT1204.001Malicious Link usesT1046Network Service Discovery usesT1140Deobfuscate/Decode Files or Infor…usesT1049System Network Connections Discov…usesT1059.005Visual Basic usesT1219.001IDE Tunneling usesT1567.002Exfiltration to Cloud Storage usesT1053.005Scheduled Task usesT1087.002Domain Account usesS0596ShadowPad usesT1598.003Spearphishing Link usesT1678Delay Execution usesT1564.001Hidden Files and Directories usesT1218.005Mshta usesT1027.007Dynamic API Resolution usesT1585.002Email Accounts