Mustang Panda
Also known as: TA416, RedDelta, BRONZE PRESIDENT, Stately Taurus, Earth Preta, Twill Typhoon
Mustang Panda sends tailored phishing lures with decoy documents and loads its PlugX backdoor through DLL sideloading of legitimate, signed programs. Some PlugX variants spread through USB drives; in 2025 US authorities deleted PlugX from thousands of infected US computers.
- Public attribution
- Described by MITRE ATT&CK as a China-based espionage actor; in January 2025 the US DOJ described the operators of its PlugX malware as PRC state-sponsored.
- Active since
- Around 2012
- Targets
- Government and diplomatic organisations
- NGOs, think tanks and religious organisations
- Southeast Asia, Europe, Mongolia and the US
Notable campaigns
2022European government targeting
Proofpoint reported increased phishing against European governments using web bugs and PlugX as the war in Ukraine escalated.
2023Southeast Asian government espionage
Unit 42 linked espionage against a Southeast Asian government to the group.
2025PlugX deletion operation
The US DOJ and FBI, with French partners, announced the court-authorised deletion of PlugX from about 4,200 US computers.
Signature ATT&CK techniques
- T1566.002Phishing: Spearphishing Link
- T1204.002User Execution: Malicious File
- T1574.001Hijack Execution Flow: DLL
- T1091Replication Through Removable Media
- T1052.001Exfiltration Over Physical Medium: Exfiltration over USB
- T1560.001Archive Collected Data: Archive via Utility
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Block or sandbox archive and shortcut files arriving by email and links to file-sharing sites.
- Alert when signed executables load DLLs from user-writable folders (DLL sideloading).
- Control removable media with device policy and scan it on insertion.
- Train diplomatic and policy staff on tailored lures that reference current events.