Loading story…
Avast linked a malware distribution and staging infrastructure with high confidence to a Mustang Panda-related threat actor that collected and staged large volumes of stolen data from organizations tied to Myanmar. The campaign targeted government ministries, the Office of the State Administrative Council, police, military entities, embassies, NGOs, and opposition groups, and the exposed material reportedly included documents, emails, browser profiles, audio recordings, military information, diplomatic files, and passport scans belonging to foreign citizens and diplomats.
Investigators found an FTP server used to host modular malware and temporarily store exfiltrated victim data, with the operation later shifting to HTTP infrastructure protected only by weak credentials while also using Google Drive, GitHub, and watercaltropinfo domains to support exfiltration and token management. Avast said the tooling and tradecraft overlapped with previously reported Mustang Panda and LuminousMoth activity, including Korplug variants, Delphi USB launchers, DLL sideloading chains, and Google Drive-based exfiltration, alongside additional components such as the Go-based JSX RAT, keyloggers, file monitors, audio capture tools, modular backdoors, and remote shell capabilities.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
On 2022-12-02, Avast published research describing the actor's infrastructure evolution from anonymous FTP in Malaysia to HTTP with weak credentials, along with use of Google Drive, GitHub, and watercaltropinfo domains. The report also detailed malware and tradecraft associated with the campaign, including Korplug variants, Delphi USB launchers, DLL sideloading chains, a Go-based RAT called JSX, keyloggers, file monitors, audio capture tools, and remote shell capabilities.
Avast reported a malware distribution and staging infrastructure linked with high confidence to a Mustang Panda-related threat actor targeting Myanmar government ministries, military and police organizations, embassies, NGOs, and opposition groups. The operation involved large-scale collection and temporary storage of exfiltrated victim data, including documents, emails, browser profiles, audio recordings, military information, diplomatic materials, and passport scans.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 135 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked espionage group **Earth Preta**—also tracked as **Mustang Panda**—updated its intrusion playbook to improve stealth, shifting from phishing emails with embedded malicious archives or direct cloud links to decoy documents that provide Google Drive links and passwords for protected archives. Those archives delivered malware including **TONEINS**, **TONESHELL**, and **PUBLOAD**, while follow-on activity used backdoors and loaders such as **CLEXEC**, **COOLCLIENT**, **TROCLIENT**, **PlugX**, and MQTT-based implants including **QMAGENT/MQsTTang**. Separate reporting tied Mustang Panda activity to targeted attacks in Asia, including Southeast Asia and likely Japan, where the group was also observed using malware such as **Claimloader**. Researchers said the actor expanded its post-compromise toolkit with privilege-escalation and lateral-movement utilities including **ABPASS**, **CCPASS**, **HIUPAN**, **ACNSHELL**, and abuse of **SilentCleanup** for elevation. For data theft, the group relied on both legitimate tools such as **WinRAR**, `curl`, and FTP and custom packers **NUPAKAGE** and **ZPAKAGE** to collect and encrypt sensitive documents for exfiltration. Infrastructure overlaps, malware artifacts, and developer traces—including the name **"TaoZongjie"** and the GitHub account **`YanNaingOo0072022`**—were cited as links across the broader Earth Preta intrusion set, underscoring a sustained and adaptive regional cyber-espionage campaign.
Aug 15, 2026
Researchers reported that the China-linked espionage group **Mustang Panda** (`TA416`, `RedDelta`, `PKPLUG`) has run a long-lived phishing campaign since at least August 2021 against European diplomatic missions, internet service providers, and research organizations, with many observed victims in Mongolia, Vietnam, and Myanmar and additional targeting in Europe and Africa. The lures used decoy documents tied to current events and government themes, including Ukraine border tensions, COVID-19 travel restrictions, and EU regulations, to entice targets into opening malicious files. The intrusions delivered a previously undocumented **Korplug/PlugX** variant dubbed **Hodur**, continuing a pattern of Mustang Panda PlugX activity seen in earlier Exchange-related and Myanmar-focused operations. The infection chain commonly relied on DLL side-loading with legitimate signed executables such as **SmadAV**, a malicious loader, and an encrypted payload, sometimes preceded by a downloader fetching components over HTTPS. Analysts said the malware introduced stronger obfuscation, encrypted strings and payloads, anti-analysis features, registry or scheduled-task persistence, and encrypted command-and-control over HTTPS or custom TCP with **RC4**, enabling reconnaissance, file theft, remote shell access, and broader espionage operations.
Aug 15, 2026
Darktrace linked a cyberespionage campaign targeting Asia-Pacific government entities to the Chinese state-aligned group **Mustang Panda**—also tracked as **Twill Typhoon** and **Earth Preta**—after observing the actor evolve its known `.NET` downloader **FDMTP** into a more modular backdoor. The updated framework reportedly supports plugin loading, updates, and persistence while hiding behind legitimate-looking Windows and developer-related processes, indicating a shift from a simple downloader to a more flexible remote access platform. Researchers said compromised hosts had been contacting spoofed domains impersonating CDN infrastructure associated with brands including **Yahoo** and **Apple** since September 2025, and that the attackers repeatedly paired legitimate Windows binaries with malicious DLLs to side-load FDMTP. In one April incident, a finance-sector endpoint fetched binaries, configuration files, and DLL components from **`yahoo-cdn.it.com`** over an 11-day period, underscoring the group's use of modular tooling, deceptive infrastructure, and adaptable persistence techniques in ongoing espionage operations.
Jun 29, 2026