# Mustang Panda Bronze President

Adversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill mustang-panda-bronze-president -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill mustang-panda-bronze-president -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill mustang-panda-bronze-president -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill mustang-panda-bronze-president -g -a gemini-cli -y`

## Description

Adversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately Taurus / RedDelta / TA416 / TEMP.Hex), a China-based state-sponsored cyber-espionage actor operating since at least 2012.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Mustang Panda (Bronze President, Stately Taurus, RedDelta, TA416), Adversary Emulation Profile

Mustang Panda (MITRE ATT&CK **G0129**) is a China-based cyber-espionage threat actor conducting operations since at least **2012**. Tracked under a dozen aliases, **Bronze President** (Secureworks), **Stately Taurus / FIREANT** (Unit 42), **RedDelta** (Recorded Future), **TA416** (Proofpoint), **Earth Preta** (Trend Micro), **HIVE0154** (IBM X-Force), **Camaro Dragon** (Check Point), **Twill Typhoon / TANTALUM** (Microsoft), **LUMINOUS MOTH**, **UNC6384 / TEMP.Hex** (Mandiant/Google TAG), **Red Lich** (PwC), and **ClumsyToad** (Cloudflare), the group is best known for its prolific use of **PlugX/Korplug** RAT variants delivered through DLL side-loading, themed spearphishing lures, and USB-based propagation. Mustang Panda targets government, diplomatic, military, NGO, think-tank, and religious entities across Southeast Asia, Europe, and beyond, with sustained focus on Myanmar, Vietnam, the Philippines, Cambodia, Taiwan, Japan, Mongolia, and, since 2022, European diplomatic bodies and Russia-related targets.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/mustang-panda/SKILL.md