Mustang Panda
aka Twill Typhoon, Earth Preta, Stately Taurus, RedDelta, BRONZE PRESIDENT, TEMP.Hex, UNC6384
A Chinese espionage group that targets governments, diplomats, NGOs and religious groups. It uses the PlugX remote-control malware, which US authorities removed from about 4,200 computers in 2025.
- Alert level
- 1/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Assessed as PRC state-sponsored — US DOJ and FBI
- Assessed the PRC-nexus UNC6384 activity as associated with Mustang Panda — Google Threat Intelligence Group
How they attack
Entry
Sending tailored decoy documents
Like mailing an envelope that looks relevant to the target's job, with a bug that activates when opened.
Entry
Hijacking connection checks to push fake updates
Like swapping the hotel's Wi-Fi sign so guests install a fake 'required app'.
Inside
Hiding inside legitimate software
Like slipping through the gate right behind someone with a real employee badge.
Goal
Remote-controlled spying
Like hiding a small camera on the target's desk that can be steered from far away at any time.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily