Menu

Individual skill

mustang-panda-bronze-president

Adversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately Taurus / RedDelta / TA416 / TEMP.Hex), a China-based state-sponsored cyber-espionage actor operating since at least 2012.

packages/decepticon/decepticon/skills/shared/adversary-emulation/mustang-panda/SKILL.md

Read pinned source

Source commit cc6044561ff32188dc0aa899bcc7d3666ffcfd1c

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 2, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
6,560
Repository last updated
Nov 7, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Declared tags are partial or unavailable.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Mustang Panda (Bronze President, Stately Taurus, RedDelta, TA416) — Adversary Emulation Profile

Mustang Panda (MITRE ATT&CK **G0129**) is a China-based cyber-espionage threat actor conducting operations since at least **2012**. Tracked under a dozen aliases — **Bronze President** (Secureworks), **Stately Taurus / FIREANT** (Unit 42), **RedDelta** (Recorded Future), **TA416** (Proofpoint), **Earth Preta** (Trend Micro), **HIVE0154** (IBM X-Force), **Camaro Dragon** (Check Point), **Twill Typhoon / TANTALUM** (Microsoft), **LUMINOUS MOTH**, **UNC6384 / TEMP.Hex** (Mandiant/Google TAG), **Red Lich** (PwC), and **ClumsyToad** (Cloudflare) — the group is best known for its prolific use of **PlugX/Korplug** RAT variants delivered through DLL side-loading, themed spearphishing lures, and USB-based propagation. Mustang Panda targets government, diplomatic, military, NGO, think-tank, and religious entities across Southeast Asia, Europe, and beyond, with sustained focus on Myanmar, Vietnam, the Philippines, Cambodia, Taiwan, Japan, Mongolia, and — since 2022 — European diplomatic bodies and Russia-related targets.

## Attribution & motivation

- **Sponsor / nation:** People's Republic of China — assessed as a state-sponsored espionage actor with a Chinese nexus. CrowdStrike first attributed the group in 2017; subsequent reporting from Secureworks, Recorded Future, Proofpoint, Trend Micro, Unit 42, Check Point, IBM X-Force, and Google TAG consistently attribute operations to PRC interests. A December 2024 U.S. DOJ affidavit supported seizure of U.S.-based computers infected with Mustang Panda's PlugX malware, formally linking the tool to PRC state-sponsored activity.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** aligned with PRC foreign-policy interests — diplomatic, military, and political intelligence from Southeast Asian governments, European diplomatic bodies, and organizations involved in issues sensitive to Beijing (Tibet, Taiwan, South China Sea, religious organizations).
- **Attribution confidence:** **High.** Backed by consistent multi-vendor reporting (CrowdStrike, Secureworks, Recorded Future, Proofpoint, Unit 42, Trend Micro, ESET, Check Point, IBM X-Force, Google TAG, Zscaler), U.S. DOJ law-enforcement action (2024 PlugX seizure warrant), and shared infrastructure/tooling overlap across campaigns spanning 10+ years.

## Targeting

- **Sectors:** Government and diplomatic bodies (ministries of defense and foreign affairs); military; NGOs, think tanks, and civil-society organizations; religious institutions (Vatican, Catholic organizations, Tibetan community); research and academic entities; telecommunications; media.
- **Regions:** Southeast Asia (Myanmar, Vietnam, Philippines, Cambodia, Laos, Indonesia, Malaysia); East Asia (Taiwan, Japan, Mongolia); South Asia (Pakistan); Europe (EU institutions, Germany, France); United States; Russia (post-2022 Ukraine conflict); Australia.