Mustang Panda Feeds Worm-Driven USB Attack Strategy

Trend Micro reports renewed activity from the China-linked APT Mustang Panda (aka Earth Preta) conducting time-sensitive cyber-espionage operations across APAC governments using a self-propagating USB worm (HIUPAN) to distribute a stager (PUBLOAD) and additional tools (FDMTP, PTSOCKET), alongside fast-paced spear‑phishing delivering multistage downloaders that culminate in backdoors (e.g., CBROVER) for persistent access and data exfiltration; researchers provide TTPs and IoCs and warn of ongoing targeted operations.