Mustang Panda Threat Actor Profile Guide: PlugX, TONESHELL and USB campaigns, and how to hunt them

Mustang Panda is a China-based espionage group that keeps reaching government, diplomatic and civil society networks with the same simple ingredients: a convincing lure, a legitimately signed program that side-loads a malicious DLL, and malware that can spread by USB drive. It has operated since at least 2012 and has one of the largest technique lists of any China nexus group in MITRE ATT&CK v20. This profile is for SOC analysts, threat hunters and security teams in government, NGOs, think tanks and organisations working on Asia policy. It covers the group's many names, its targeting, its malware families (PlugX, TONESHELL, PUBLOAD and their loaders), how it steals and uses domain credentials, notable operations to 2025, and a hunting and defence summary. Group context sits in the Threat Actor Groups Guide.

Key takeaways

• Side-loading is the signature. Most chains end with a legitimate, often signed, executable loading a malicious DLL next to it (T1574.001), which makes application control and DLL load monitoring the most useful defences.
• USB still matters. PlugX and the HIUPAN worm replicate through removable media (T1091); in January 2025 the US Justice Department announced the deletion of a Mustang Panda PlugX version from about 4,258 US computers.
• Once inside, it goes for the domain. Unit 42 documented Mimikatz against LSASS, DCSync and NTDS.dit theft through volume shadow copies in a Southeast Asian government network.
• Its own traffic pretends to be TLS. TONESHELL and PUBLOAD use fake TLS headers without a real handshake, a pattern that network sensors can hunt.
• Edge devices and captive portals are newer entry points. GTIG reported UNC6384, likely associated with Mustang Panda, hijacking captive portal checks to push a signed fake plugin update to diplomats in 2025.

Who they are (names and aliases)

ATT&CK tracks the group as Mustang Panda (G0129), a China-based cyber espionage actor active since at least 2012. The US Justice Department stated in January 2025 that court documents show the PRC government paid the group to develop the PlugX version it removed. Vendor names overlap but are not always one-to-one, so treat each as a related cluster.

Other China nexus groups are covered in the China State Cyber Operations Guide. PlugX and ShadowPad are shared across several groups; see the PlugX and ShadowPad Malware Guide.

Targeting and motivation

• Victims: ATT&CK lists government, diplomatic and non-governmental organisations, including think tanks, religious institutions and research entities, across the United States, Europe and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan and Vietnam.
• 2025 targeting: IBM X-Force reported Hive0154 lures aimed at government, military and diplomatic staff in the Philippines, the United States and Pakistan, and a USB infection of a major Taiwanese manufacturer in March 2025. GTIG reported diplomats in Southeast Asia targeted by UNC6384 from March 2025.
• Lures: current political events and regional issues (South China Sea, Balochistan, spoofed National Security Council notes), invoices and legal documents, and European Commission themes in earlier campaigns.
• Motivation: intelligence collection in support of PRC strategic interests. The group archives and exfiltrates documents rather than encrypting or destroying systems.

Tactics and techniques (MITRE ATT&CK)

All techniques below are mapped to G0129 in ATT&CK v20; the right-hand column is from the government and vendor reports cited.

Malware families folded into this profile

How they abuse identities and credentials

• Domain-wide credential theft: Unit 42 describes repeated Mimikatz runs against LSASS, DCSync from a domain controller, and a volume shadow copy of a domain controller used to take NTDS.dit and the SYSTEM hive. After that, every domain account, including service accounts, must be treated as known. See the Golden Ticket, Silver Ticket and DCSync Guide and the Credential Dumping Guide.
• Abuse of trusted management agents: the group used a security product's remote administration agent to execute commands and install backdoors on other hosts, so the agent's service identity became a lateral movement channel. See the RMM Tool Security Guide.
• Logon intelligence: querying Event IDs 4624 and 4672 with wevtutil let the operators see where privileged users logged on, to choose where to dump credentials next.
• Abuse of code signing trust: signed loaders and downloaders exploit allowlists that trust any valid signature. See the Code Signing Security Guide.
• Developer tooling as C2: VS Code tunnels authenticate through the operator's GitHub account, so traffic looks like an ordinary developer session to Microsoft and GitHub endpoints.
• Compromised email accounts: ATT&CK records the group using compromised legitimate email accounts to send spear-phishing, which defeats sender reputation checks.

Notable incidents

Detection and defence

Hunting summary

Controls that break the chain

1. Application control first: deploy WDAC or AppLocker in audit mode on high-risk user groups, review side-loading candidates, then enforce. Do not trust a signature alone; restrict where signed binaries may run from. See the Application Allowlisting Guide.
2. Removable media policy: block or read-only USB storage for most users, allow approved encrypted devices, and scan all removable media on connection. See the Removable Media and USB Control Guide.
3. Protect LSASS and domain controllers: enable LSA protection and Credential Guard, alert on shadow copies and replication from non-DC hosts, and keep privileged accounts in a tiered model.
4. Control management agents: restrict who can push tasks through EDR, antivirus and RMM consoles, require MFA on those consoles, and log every remote command.
5. Egress control: restrict servers from reaching consumer cloud storage and file sharing services, and block VS Code tunnel endpoints where developers do not need them.
6. Travelling staff: require always-on VPN and Enhanced Safe Browsing for diplomats and executives on public networks. See the Public Wi-Fi Safety Guide.

Roll back application control by switching the policy back to audit mode, not by removing it; keep audit data so the next enforcement attempt is better informed.

Response priorities

• Scope removable media: collect and scan USB drives used on affected hosts, or reinfection follows cleanup.
• Assume domain compromise if NTDS.dit theft or DCSync is found: plan a full reset including service accounts and KRBTGT.
• Check management consoles for tasks or deployments you did not create.

Metrics

• Application control coverage: percentage of endpoints in high-risk groups with an enforced policy.
• USB exceptions: number of users allowed writeable removable storage.
• Side-loading alert triage time: median time to close an unsigned DLL load alert.
• LSA protection coverage: percentage of Windows endpoints and servers with LSA protection enabled.

Framework mapping

Practitioner checklist

• Load the G0129 technique set into your ATT&CK coverage view and mark gaps for T1574.001, T1091 and T1003.
• Run a side-loading hunt across C:\ProgramData\ and C:\Users\Public\ for signed EXE plus DLL pairs.
• Deploy a network rule for TLS application data without a handshake and tune it for a week.
• Set removable storage to blocked or read-only for users who do not need it.
• Enforce application control on diplomatic, policy and executive endpoints first.
• Enable LSA protection and alert on DC shadow copies and non-DC replication.
• Review who can run remote tasks through security and management agents.
• Brief travelling staff on fake plugin and update prompts on hotel and conference Wi-Fi.

Standards and references

• MITRE ATT&CK: Mustang Panda (G0129)
• MITRE ATT&CK: PlugX (S0013)
• US Department of Justice: Justice Department and FBI conduct international operation to delete malware used by China-backed hackers
• Google Threat Intelligence Group: PRC-nexus espionage hijacks web traffic to target diplomats
• IBM X-Force: Hive0154 targeting the US, Philippines, Pakistan and Taiwan
• Palo Alto Networks Unit 42: Cyberespionage attacks against Southeast Asian government linked to Stately Taurus

Related NHI Mgmt Group resources: Threat Actor Groups Guide · PlugX and ShadowPad Malware Guide · USB Drop Attacks Guide · China State Cyber Operations Guide