菜单
Adversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately Taurus / RedDelta / TA416 / TEMP.Hex), a China-based state-sponsored cyber-espionage actor operating since at least 2012.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/PurpleAILAB/Decepticon --skill mustang-panda-bronze-president命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | mustang-panda-bronze-president |
| description | Adversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately Taurus / RedDelta / TA416 / TEMP.Hex), a China-based state-sponsored cyber-espionage actor operating since at least 2012. |
| allowed-tools | Bash Read Write |
| metadata | {"subdomain":"adversary-emulation","when_to_use":"Mustang Panda, Bronze President, Stately Taurus, RedDelta, TA416, TEMP.Hex, Earth Preta, Camaro Dragon, HIVE0154, Twill Typhoon, G0129, Chinese espionage emulation, PlugX / Korplug RAT, TONESHELL loader, DLL side-loading, USB worm propagation, spearphishing with themed lures, SE Asian government targeting, EU diplomatic targeting, Vatican targeting","tags":"mustang-panda, bronze-president, stately-taurus, reddelta, ta416, temp-hex, earth-preta, camaro-dragon, china, espionage, nation-state, g0129, adversary-emulation, mitre-attack","mitre_attack":"T1087.002, T1583.001, T1583.006, T1557, T1071.001, T1560.001, T1560.003, T1119, T1547.001, T1059, T1059.001, T1059.003, T1059.005, T1059.007, T1586.002, T1001.003, T1074.001, T1622, T1678, T1140, T1587.001, T1573.001, T1585.002, T1546.003, T1480, T1048.003, T1041, T1052.001, T1567.002, T1203, T1083, T1564.001, T1574.001, T1574.005, T1070, T1070.004, T1070.006, T1105, T1654, T1036.004, T1036.005, T1036.007, T1036.008, T1106, T1046, T1095, T1027, T1027.007, T1027.012, T1027.013, T1027.016, T1588.002, T1588.003, T1588.004, T1003, T1003.001, T1003.003, T1003.006, T1069.002, T1566.001, T1566.002, T1598.003, T1057, T1572, T1090, T1219.001, T1219.002, T1018, T1091, T1053.005, T1593, T1505.003, T1129, T1072, T1518, T1176.002, T1608, T1608.001, T1553.002, T1218.004, T1218.005, T1218.007, T1218.014, T1082, T1016, T1049, T1205, T1204.001, T1204.002, T1102, T1047"} |
Mustang Panda (MITRE ATT&CK G0129) is a China-based cyber-espionage threat actor conducting operations since at least 2012. Tracked under a dozen aliases — Bronze President (Secureworks), Stately Taurus / FIREANT (Unit 42), RedDelta (Recorded Future), TA416 (Proofpoint), Earth Preta (Trend Micro), HIVE0154 (IBM X-Force), Camaro Dragon (Check Point), Twill Typhoon / TANTALUM (Microsoft), LUMINOUS MOTH, UNC6384 / TEMP.Hex (Mandiant/Google TAG), Red Lich (PwC), and ClumsyToad (Cloudflare) — the group is best known for its prolific use of PlugX/Korplug RAT variants delivered through DLL side-loading, themed spearphishing lures, and USB-based propagation. Mustang Panda targets government, diplomatic, military, NGO, think-tank, and religious entities across Southeast Asia, Europe, and beyond, with sustained focus on Myanmar, Vietnam, the Philippines, Cambodia, Taiwan, Japan, Mongolia, and — since 2022 — European diplomatic bodies and Russia-related targets.
RECYCLE.BIN folders on removable media — critical for air-gapped network access.cmd.exe; batch scripts for collection; used cmd.exe /c ping.exe 8.8.8.8 -n 70&& delay-execution chains.autorun.vbs persistence scripts.wscript.exe.LoadLibrary to dynamically load DLLs.HKLM\...\Run\AdobelmdyU, HKCU\...\Run) with legitimate-sounding names (e.g., OneNote Update) pointing to executables that side-load malicious DLLs.inkform.exe, ExcelRepairToolboxLauncher.exe) to side-load malicious DLLs — the defining delivery mechanism for PlugX, TONESHELL, PUBLOAD, and other payloads.IRSetup.exe) to drop and execute payloads.OneNote Update).adobeupdate.dat, PotPlayerDB.dat, OneDrive.exe, AdobePlugins.exe.CheckRemoteDebuggerPresent API and exits if debugger detected.ping 8.8.8.8 -n 70 echo requests before executing legitimate executables.InstallUtil.exe to execute malicious Cobalt Strike Beacon stager.mshta.exe to launch collection scripts.RECYCLE.BIN folders on USB drives; modified file attributes to hidden and system.17 03 03 or 46 77 4d); only executes in memory when response packets match.vssadmin to create volume shadow copies and retrieve NTDS.dit; used reg save on SYSTEM hive to extract NTDS.tasklist /v; TONESHELL checks process name and path for environment validation.systeminfo; captured OS type via User-Agent analysis.ipconfig, arp, and SharpNBTScan.netstat -ano.InstallUtil.exe and its version.sshd.exe) to execute commands, transfer files, and spread across environments over SMB port 445.code.exe tunnel command with established GitHub accounts for persistent remote access.code.exe tunnel.rar.exe to create password-protected archives; also used TONESHELL, RemCom, and Impacket to execute WinRAR for archival.c:\windows\temp; stored documents in hidden USB folders.cmd.exe; TCP 5000 for administrative C2 node communication.DevTunnel.exe) for tool propagation.curl.| Name | ATT&CK ID | Type | Public/Custom |
|---|---|---|---|
| PlugX / Korplug (incl. Hodur variant) | S0013 | Modular Windows RAT (DLL side-loading, USB worm, keylogging, screen capture) | Custom |
| TONESHELL | S1239 | Multi-variant backdoor/loader with anti-analysis, FakeTLS C2 | Custom |
| PUBLOAD | S1228 | First-stage stager/downloader with environment-keyed execution | Custom |
| HIUPAN | S1230 | USB worm for propagation via removable media | Custom |
| BOOKWORM | S1226 | Modular implant (keylogging, clipboard, FakeTLS C2) | Custom |
| StarProxy | S1227 | Internal network proxy with FakeTLS and DLL side-loading | Custom |
| PAKLOG | S1233 | Keylogger/clipboard monitor | Custom |
| CorKLOG | S1235 | Encrypted keylogger with service persistence | Custom |
| SplatCloak | S1234 | Kernel-mode driver for EDR/AV evasion | Custom |
| SplatDropper | S1232 | Dropper for SplatCloak driver payloads | Custom |
| CLAIMLOADER | S1236 | Loader with COM-based execution and DLL side-loading | Custom |
| CANONSTAGER | S1237 | Stager with thread-local-storage injection | Custom |
| STATICPLUGIN | S1238 | COM-based loader disguised as document files | Custom |
| RCSession | S0662 | Backdoor with UAC bypass and fileless storage | Custom |
| PoisonIvy | S0012 | Legacy Windows RAT (DLL injection, rootkit) | Custom (older) |
| ShadowPad | S0596 | Modular backdoor platform (shared across Chinese APTs) | Custom (shared) |
| ORat | — | Custom RAT with WMI event-subscription persistence | Custom |
| Cobalt Strike | S0154 | Post-exploitation framework / Beacon | Public |
| China Chopper | S0020 | Web shell | Public |
| Mimikatz | S0002 | Credential dumping | Public |
| Impacket | S0357 | Network protocol / lateral-movement toolkit | Public |
| AdFind | S0552 | Active Directory enumeration | Public |
| NBTscan | S0590 | NetBIOS scanner | Public |
| Wevtutil | S0645 | Windows Event Log utility | Built-in |
| TeamViewer | — | Remote desktop software | Public (Commercial) |
Authorized-use caveat: Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never deploy USB-propagation worms or kernel-mode drivers outside an explicitly sanctioned, isolated lab.
Map Mustang Panda's signature plays to Decepticon's own capabilities:
inkform.exe, or antivirus agent), (2) a malicious DLL matching the expected side-load name, and (3) an encrypted payload blob (.dat). The signed EXE loads the DLL, which decrypts and executes the payload in memory. Vary the signed EXE across engagements to test detection coverage.RECYCLE.BIN directory on removable media containing the side-loading triad plus an autorun trigger. Test whether endpoint detection catches the worm's USB-based spread and hidden-folder creation.ping -n 70 chains before launching the legitimate side-loading executable. Test mshta.exe and InstallUtil.exe proxy execution paths.OneNote Update, AdobelmdyU) pointing to the side-loading executable. Create scheduled tasks for backup persistence. Where testing WMI depth, set up WMI event subscriptions emulating ORat's consumer-based persistence.vssadmin shadow copies — matching Mustang Panda's documented post-compromise credential-harvesting pattern.code.exe tunnel with a GitHub account for persistent C2-like access. Combine with OpenSSH tunneling over SMB (port 445) for internal pivoting. This novel technique is increasingly common in Mustang Panda's 2023-2024 operations.17 03 03) to non-TLS TCP traffic to emulate TONESHELL/StarProxy's protocol impersonation. Proxy through Cloudflare CDN (T1090) to replicate RedDelta's infrastructure pattern. Use RC4 encryption for the C2 channel.rar.exe using password protection. Exfiltrate over the C2 channel or via curl to Dropbox/Google Drive to replicate the cloud-exfil pattern. Stage in c:\windows\temp before exfil.CheckRemoteDebuggerPresent), dynamic API resolution via hashed function names, junk code insertion, and geofencing/environment-keying guardrails.%TEMP%, %APPDATA%, USB drives); alert on unsigned DLLs loaded by signed executables; deploy application-control/allowlisting (WDAC/AppLocker) to block unapproved DLL loads.mmc.exe) executing MSC files from user-writable paths; strip or quarantine archive attachments (RAR/ZIP) containing executables.RECYCLE.BIN directories on removable drives; alert on attrib.exe +h +s usage; block autorun on removable media.%TEMP%, %APPDATA%, or non-standard paths; hunt for scheduled tasks creating reverse shells or referencing code.exe tunnel; audit WMI event subscriptions.vssadmin create shadow or ntdsutil invocations, and DCSync replication from non-DC accounts; monitor for reg save targeting SAM/SYSTEM/SECURITY hives.code.exe tunnel or DevTunnel.exe execution; block or alert on outbound connections to *.devtunnels.ms and *.vscode.dev; restrict Visual Studio Code installation to authorized developer systems.17 03 03) that fail proper TLS negotiation; monitor for unusual traffic patterns on non-standard ports.curl.exe); restrict cloud-storage application access via CASB; alert on new OAuth app consent grants.rar.exe a -hp); monitor FTP client usage; alert on large data transfers to external IPs from staging directories (c:\windows\temp).FileDelete events; monitor for timestomping patterns; alert on process/file deletion immediately following execution.