Mustang Panda Bronze President
Adversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately...
Install
npx skills add BitterSecurity/Decepticon --skill mustang-panda-bronze-president -g -a claude-code -y- Repository
- BitterSecurity/Decepticon6.5k
- Category
- Engineering
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Adversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately Taurus / RedDelta / TA416 / TEMP.Hex), a China-based state-sponsored cyber-espionage actor operating since at least 2012.
Mustang Panda (Bronze President, Stately Taurus, RedDelta, TA416), Adversary Emulation Profile
Mustang Panda (MITRE ATT&CK G0129) is a China-based cyber-espionage threat actor conducting operations since at least 2012. Tracked under a dozen aliases, Bronze President (Secureworks), Stately Taurus / FIREANT (Unit 42), RedDelta (Recorded Future), TA416 (Proofpoint), Earth Preta (Trend Micro), HIVE0154 (IBM X-Force), Camaro Dragon (Check Point), Twill Typhoon / TANTALUM (Microsoft), LUMINOUS MOTH, UNC6384 / TEMP.Hex (Mandiant/Google TAG), Red Lich (PwC), and ClumsyToad (Cloudflare), the group is best known for its prolific use of PlugX/Korplug RAT variants delivered through DLL side-loading, themed spearphishing lures, and USB-based propagation. Mustang Panda targets government, diplomatic, military, NGO, think-tank, and religious entities across Southeast Asia, Europe, and beyond, with sustained focus on Myanmar, Vietnam, the Philippines, Cambodia, Taiwan, Japan, Mongolia, and, since 2022, European diplomatic bodies and Russia-related targets.
