Dark Web Profile: Mustang Panda

Mustang Panda is a long-running China-aligned cyber espionage actor tracked since at least 2012; this report documents its evolving toolkit (including PlugX, LOTUSLITE, ZOHOMURK, MINIRECON, SHARDLOADER), tradecraft (spearphishing, DLL sideloading, abuse of legitimate cloud services), a June 2026 pair of campaigns against Indian government and hydropower targets, enumerated IOCs (domains, IPs, hashes, registry/scheduled task artifacts), MITRE ATT&CK mappings, and practical mitigation and detection guidance for defenders.