Mustang Panda
MITRE G0129Also known as RedDelta, HoneyMyte (Mustang Panda), TA416, MUSTANG PANDA, Earth Preta, Mustang Panda, Bronze President, HIVE0154, Stately Taurus
Reports
13
First seen
Nov 6, 2025
Last seen
Oct 8, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Victim regions
×1×1
Japan×1
India×1
Myanmar (Burma)×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1566 Phishing ×10T1190 Exploit Public-Facing Application ×7T1041 Exfiltration Over C2 Channel ×5T1078 Valid Accounts ×5T1195 Supply Chain Compromise ×5T1005 Data from Local System ×4T1218 System Binary Proxy Execution ×4T1486 Data Encrypted for Impact ×4T1555 Credentials from Password Stores ×3T1598 Phishing for Information ×3T1003 OS Credential Dumping ×3T1557 Adversary-in-the-Middle ×2
Indicators
filename ×57cve ×17domain ×13ip_v4 ×2
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2022-1388 (exploited)CVE-2024-24919 (exploited)CVE-2025-29635 (exploited)CVE-2025-53690 (exploited)CVE-2025-55182 (exploited)CVE-2025-64155CVE-2025-8088 (exploited)CVE-2026-11645 (exploited)CVE-2026-1281 (exploited)CVE-2026-20045 (exploited)CVE-2026-20230 (exploited)CVE-2026-21509 (exploited)CVE-2026-28318 (exploited)CVE-2026-28950CVE-2026-33626 (exploited)CVE-2026-40372CVE-2026-42897 (exploited)
Recent reports
unrated