Loading malware…
NUPAKAGE is a custom Windows data-packaging and exfiltration malware associated with the Chinese espionage actor Earth Preta, also known as Mustang Panda. It has been observed in cyberespionage operations targeting government entities in Southeast Asia and forms part of a broader intrusion toolkit used to collect sensitive documents from compromised systems.
The malware is designed to identify and gather selected document types, including common office and PDF formats, typically constrained by operator-specified date ranges. It requires a passcode to run, indicating deliberate operator control rather than indiscriminate deployment. After collecting files, NUPAKAGE packages the data into a proprietary encrypted archive format and also generates a fake ZIP-style log artifact, supporting staged theft and later transfer through attacker-controlled channels.
NUPAKAGE’s role is specialized: it is not primarily an initial-access implant or general-purpose backdoor, but a tailored utility for preparing victim data for exfiltration. In campaigns attributed to Earth Preta, it has been used alongside other malware families, loaders, backdoors, privilege-escalation tools, and lateral-movement utilities, reflecting its place in a mature post-compromise espionage workflow. Its use is consistent with long-term intelligence collection operations focused on sensitive political, military, diplomatic, and administrative information.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We named this malware “NUPAKAGE," a name derived from its unique PDB string, D:\Project\NEW_PACKAGE_FILE\Release\NEW_PACKAGE_FILE.pdb .
5 distinct techniques documented for this family, organized by ATT&CK tactic.
a customized tool used for exfiltration... Cluster Charlie activity was later observed attempting to exfiltrate sensitive information... Collection and exfiltration of a large volume of data, including sensitive military and political documents, data on infrastructure architecture, and credentials/tokens for further in-depth access.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A file-collection theft tool used to collect specific file types modified after a given date.
A customized malware tool used for data exfiltration.
Customized exfiltration/stealing tool detected in early compromise activity; publicly attributed by Trend Micro to Earth Preta (Mustang Panda).
NUPAKAGE is a backdoor developed by Mustang Panda for espionage and persistent access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.