​The U.S. Department of Justice announced today that the FBI has deleted Chinese PlugX malware from over 4,200 computers in networks across the United States.

In Part 1 of this series, we explore Mustang Panda’s latest tools: ToneShell & StarProxy, which provide features including remote access and lateral movement.

The Chinese APT hacking group "Mustang Panda" has been spotted abusing the Microsoft Application Virtualization Injector utility as a LOLBIN to inject malicious payloads into legitimate processes to e...

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

A new spy campaign by Mustang Panda uses fake US diplomatic briefings to target government officials. Discover how this silent surveillance op works.

Mustang Panda is using a new LOTUSLITE backdoor to target Indian banks and Korean diplomats. Learn how this DLL sideloading attack works.

Follow the Graylog Security Team as they show you how to detect Mustang Panda's Use of MAVInject Malware on Windows.

Acronis Threat Research Unit (TRU) has been tracking two concurrent campaigns orchestrated by Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used in the Indian government sector.

Arctic Wolf Labs has identified an active cyber espionage campaign by Chinese-affiliated threat actor UNC6384 targeting European diplomatic entities in Hungary, Belgium, and additional European nation...

The Chinese APT group TA416 (Mustang Panda) has launched new cyber-espionage campaigns targeting European governments, using evolving tactics like MSBuild abuse to deliver PlugX malware.

Mustang Panda escalates cyber espionage in Asia with advanced DOPLUGS malware. Discover how this China-linked group targets nations with sophisticated

Chinese APT group Mustang Panda exploits Visual Studio Code to target Southeast Asian governments, revealing new cybersecurity threats and sophisticated espionage tactics.

At a Glance Actor or Group: HoneyMyte (also known as Mustang Panda) Activity Type: Cyber-espionage and rootkit deployment Targets or Victims: Government entities and organizations in Asia and Russia Scale: Multiple intrusions across Myanmar, Mongolia, Pakistan, and Russia Jurisdiction Status: Unindicted suspected state-sponsored threat group Source: Kaspersky Labs, with previous tracking by Sophos and Trend Micro TL;DR Security researchers discovered an updated variant of the HoneyMyte CoolClient…

The threat group HoneyMyte, also tracked as Mustang Panda, has begun deploying an updated version of its CoolClient backdoor alongside a signed Windows kernel-level driver. Kaspersky's Securelist team documented the campaign in detail, revealing that the driver conceals malicious processes, files, registry keys, and command-server connection data, while also preventing other software from deleting or modifying protected components. Infected systems were identified in Myanmar, Mongolia, Pakistan, and Russia, including within government organizations.