Mustang Panda

Origen🇨🇳 China

Técnicas (MITRE ATT&CK)85

FuenteMITRE ATT&CK

Patrocinio estatal: ChinaConfianza de atribución: 50%Categorías objetivo: Civil society

Regiones atacadas: United States · Germany

También conocido como:BASINBASIN CASTLEBRONZE PRESIDENTCAMARO DRAGONClumsyToadEARTH PRETAEarth PretaFIREANTHIVE0154Hive0154HoneyMyteITG27LUMINOUS MOTHLuminousMothPolarisRed LichRedDeltaSTATELY TAURUSStately TaurusTA416TANTALUMTEMP.HEXTEMP.HexTWILL TYPHOONTwill TyphoonUNC6384UNK_SteadySplit

Sobre el grupo

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam.

Cadena de ataque

Escenario plausible montado a partir de las técnicas reales del grupo, ordenadas por las fases de un ataque. Cada etapa muestra cómo suele actuar el grupo.

Severidad del arsenal82

Impacto: Alto

Cadena ilustrativa derivada de las técnicas documentadas en MITRE ATT&CK — no representa un ataque específico ya ocurrido. La severidad resume el arsenal conocido (cobertura de la cadena, CVEs en explotación activa, técnicas).

Técnicas (MITRE ATT&CK) 85

Cómo opera el grupo, mapeado por la matriz MITRE ATT&CK y organizado por las fases de un ataque.

Reconocimiento

Search Open Websites/Domains Spearphishing Link

Preparación de recursos

Domains Web Services Email Accounts Email Accounts Malware Tool Code Signing Certificates Digital Certificates Stage Capabilities Upload Malware

Acceso inicial

Spearphishing Attachment Spearphishing Link

Ejecución

Windows Management Instrumentation Scheduled Task Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Software Deployment Tools Native API Shared Modules Exploitation for Client Execution Malicious Link Malicious File

Persistencia

IDE Extensions Web Shell Registry Run Keys / Startup Folder

Escalada de privilegios

Windows Management Instrumentation Event Subscription

Acceso a credenciales

OS Credential Dumping LSASS Memory NTDS DCSync Adversary-in-the-Middle

Descubrimiento

System Network Configuration Discovery Remote System Discovery Network Service Discovery System Network Connections Discovery Process Discovery Domain Groups System Information Discovery File and Directory Discovery Domain Account Software Discovery Log Enumeration

Movimiento lateral

Replication Through Removable Media

Recolección

Local Data Staging Automated Collection Archive via Utility Archive via Custom Method

Comando y control

Protocol or Service Impersonation Web Protocols Non-Application Layer Protocol Web Service Ingress Tool Transfer IDE Tunneling Remote Desktop Software Protocol Tunneling Symmetric Cryptography

Exfiltración

Exfiltration Over C2 Channel Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration over USB Exfiltration to Cloud Storage

defense-impairment

Code Signing

stealth

Obfuscated Files or Information Dynamic API Resolution LNK Icon Smuggling Junk Code Insertion Match Legitimate Resource Name or Location Double File Extension Masquerade File Type Indicator Removal File Deletion Timestomp Deobfuscate/Decode Files or Information Traffic Signaling InstallUtil Mshta Hidden Files and Directories DLL Executable Installer File Permissions Weakness Debugger Evasion Delay Execution

Vulnerabilidades explotadas 1

CVEs que este grupo es conocido por explotar, según MITRE ATT&CK. Ordenadas por gravedad real.

CVE-2017-0199HIGHEPSS 100%KEV MITRE ATT&CK

Infraestructura conocida 2996

Indicadores reales (C2, dominios, URLs y hashes) asociados al malware que usa este grupo. Fuente: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port114.215.184.158:8000Cobalt Strikethreatfox

urlhttp://69.49.229.88:443/MQEwCobalt Strikethreatfox

ip:port154.12.17.20:8080Cobalt Strikethreatfox

ip:port154.12.17.20:22Cobalt Strikethreatfox

ip:port154.12.17.20:443Cobalt Strikethreatfox

ip:port154.12.17.20:80Cobalt Strikethreatfox

ip:port129.204.55.230:443Cobalt Strikethreatfox

ip:port47.94.56.71:8080Cobalt Strikethreatfox

ip:port47.94.56.71:80Cobalt Strikethreatfox

ip:port47.94.56.71:443Cobalt Strikethreatfox

ip:port45.227.253.132:8080Cobalt Strikethreatfox

ip:port45.227.253.132:80Cobalt Strikethreatfox

ip:port45.227.253.132:443Cobalt Strikethreatfox

ip:port45.227.253.132:32775Cobalt Strikethreatfox

ip:port117.158.148.164:65535Cobalt Strikethreatfox

ip:port38.76.190.209:8888Cobalt Strikethreatfox

ip:port188.227.14.105:8080Cobalt Strikethreatfox

ip:port186.241.115.168:12443Cobalt Strikethreatfox

ip:port109.206.247.245:10881Cobalt Strikethreatfox

ip:port43.134.112.45:7500Cobalt Strikethreatfox

ip:port43.134.112.45:7000Cobalt Strikethreatfox

ip:port43.134.112.45:80Cobalt Strikethreatfox

ip:port43.134.112.45:8080Cobalt Strikethreatfox

ip:port43.134.112.45:443Cobalt Strikethreatfox

ip:port43.134.112.45:22Cobalt Strikethreatfox

ip:port101.34.208.175:18317Cobalt Strikethreatfox

sha1_hash2ff26540ebb9100dae76a2ae040108ba9338113cCobalt Strikethreatfox

md5_hashe4a34372eab0832d0682fa986a8e0b97Cobalt Strikethreatfox

sha256_hash35afe2df347cb0909fdf2aba8ed6a506a681518a98c0a723b25a16957437f944Cobalt Strikethreatfox

sha256_hash224aec5fec1f907ce152895095f56a3a2f2db0d627633ee691af56a13f34e7f8Cobalt Strikethreatfox

+2996 indicadores en total. Míralos todos en la página de IOCs.

Referencias

El grupo Mustang Panda usa técnicas y explota fallas reales. El Pentest Autónomo con IA de TrueHacking simula esos ataques en tu infraestructura y aporta más seguridad a tu aplicación.

Conocer el Pentest Autónomo con IA →