China-Based Threat Actor Mustang Panda’s TTPs Leaked

Mustang Panda, a China-based threat actor described as an advanced persistent threat, has had its tactics, techniques, and procedures (TTPs) leaked, shedding light on their long-running operations. First observed in 2017 but possibly active since 2014, the group is noted as a state-sponsored actor focusing on cyber espionage against government entities, NGOs, and religious organisations across the US, Europe, and parts of Asia.

The disclosure highlights their preference for long-term intelligence gathering via highly tailored spear-phishing campaigns and multi-stage malware payloads, with tools including PlugX, Poison Ivy, Toneshell, Pubload, and newer families such as FDMTP and PTSOCKET. A notable incident in early 2025 saw the U.S. Department of Justice and French authorities dismantling PlugX infections on over 4,200 devices via malicious USB drives, illustrating Mustang Panda’s global reach and persistence, according to the report.

The leaked TTPs align with MITRE ATT&CK TA0007, emphasising spearphishing attachments (T1566.001), living-off-the-land techniques using Msiexec (T1218.007), DLL side-loading (T1574.002), registry run keys (T1547.001), scheduled tasks (T1053.005), and new Windows services (T1543.003) to achieve persistence, while data collection and credential access cover LSASS dumping (T1003.001) and token manipulation (T1134.002), as described in the source material.