Mustang Panda

Mustang Panda has utilized AdFind to identify domain users.^[20]

Mustang Panda has acquired C2 domains prior to operations.^{[5][21][33][15][25][30][17][10][34]}

Mustang Panda registered adversary-controlled domains during RedDelta Modified PlugX Infection Chain Operations that were re-registrations of expired domains.^[32]

Mustang Panda has communicated with its C2 via HTTP POST requests.^{[3][5][15][17][34]}

Mustang Panda used HTTP POST messages for command and control from PlugX installations during RedDelta Modified PlugX Infection Chain Operations.^[32]

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.^[5][35] Mustang Panda has used WinRAR "Rar.exe" to archive stolen files before exfiltration.^[18] Mustang Panda has also used TONESHELL and post-exploitation tools such as RemCom and Impacket to execute WinRAR rar.exe to archive files for exfiltration.^[20]

Mustang Panda has created the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU to maintain persistence.^[14] Mustang Panda has also established persistence via the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.^[7][12]

Mustang Panda used Run registry keys with names such as OneNote Update to execute legitimate executables that would load through search-order hijacking malicious DLLS to ensure persistence during RedDelta Modified PlugX Infection Chain Operations.^[32]

Mustang Panda has compromised legitimate email accounts to use in their spear-phishing operations.^[23]

Mustang Panda has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. Mustang Panda has used FakeTLS to communicate with its C2 servers.^[13]

Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.^[5][35]

Mustang Panda has developed custom malware for use in their operations.^[2][4]

Mustang Panda has encrypted C2 communications with RC4.^[2][15] Mustang Panda has also leveraged encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.^[17]

Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns.^[16] Mustang Panda has also created fake Google accounts to distribute malware via spear-phishing emails.^[23] Mustang Panda has also created accounts for spearphishing operations including the use of services such as Proton Mail.^[27][28]

Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.^[5]

Mustang Panda has used FTP to exfiltrate archive files.^[20]

Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.^[35]

Mustang Panda has also exfiltrated archived files to cloud services such as Dropbox using curl.^[20][18]

Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data.^[35] Mustang Panda has also modified file attributes to hidden and system.^[2]

Mustang Panda stored encrypted payloads associated with PlugX installation in hidden directories during RedDelta Modified PlugX Infection Chain Operations.^[32]

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.^{[2][3][4][19][7][15][20][25][23][14][17][11][36][13]} Mustang Panda has abused legitimate executables to side-load malicious DLLs.^{[21][33][27][28][30]}

Mustang Panda used DLL search order hijacking on vulnerable applications to install PlugX payloads during RedDelta Modified PlugX Infection Chain Operations.^[32]

Mustang Panda masqueraded Registry run keys as legitimate-looking service names such as OneNote Update during RedDelta Modified PlugX Infection Chain Operations.^[32]

Mustang Panda has obtained and leveraged publicly-available tools for intrusion activities.^[4][20]

Mustang Panda has leveraged AdFind to enumerate domain groups.^[20]

Mustang Panda has used spearphishing attachments to deliver initial access payloads.^{[4][21][33][27][28][37][15][24][14]} Mustang Panda has also delivered archive files such as RAR and ZIP files containing legitimate EXEs and malicious DLLs.^[33][27][28]

Mustang Panda leveraged malicious attachments in spearphishing emails for initial access to victim environments in RedDelta Modified PlugX Infection Chain Operations.^[32]

Mustang Panda has delivered web bugs to profile their intended targets.^[16]

Mustang Panda has utilized an established Github account to create a tunnel within the victim environment using Visual Studio Code through the code.exe tunnel command.^[18]

Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence.^{[3][4][5][34]} Mustang Panda has also created a scheduled task that creates a reverse shell.^[18]

Mustang Panda has used China Chopper web shells to maintain access to victims’ environments.^[20]

Mustang Panda has leveraged Visual Studio Code’s (VSCode) embedded reverse shell feature using the command code.exe tunnel to execute code and deliver additional payloads.^[18]

Mustang Panda has used valid legitimate digital signatures and certificates to evade detection.^{[21][33][30][17][10][11][36][13]}

Mustang Panda used legitimate, signed binaries such as inkform.exe or ExcelRepairToolboxLauncher.exe for follow-on execution of malicious DLLs through DLL search order hijacking in RedDelta Modified PlugX Infection Chain Operations.^[32]

Mustang Panda has used InstallUtil.exe to execute a malicious Beacon stager.^[3]

Mustang Panda has sent malicious links including links directing victims to a Google Drive folder.^{[27][28][9][23][16][34]} Mustang Panda has also utilized webpages with Javascript code that downloads malicious payloads to the victim device.^[30]

Mustang Panda distributed hyperlinks that would result in an MSC file running a PowerShell command to download and install a remotely-hosted MSI file during RedDelta Modified PlugX Infection Chain Operations.^[32]