{"record":{"id":"ATTACK:enterprise:S0013","title":"PlugX","type":"Software","source_url":"https://attack.mitre.org/software/S0013","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"malware--64fa0de0-6240-41f4-8638-f4ca7ed528fd","external_id":"S0013","domain":"enterprise","created":"2017-05-31T21:32:15.638Z","modified":"2026-05-12T15:12:00.734Z","version":"3.3","aliases":[],"tactics":[],"source_references":[{"source_name":"DestroyRAT"},{"source_name":"Kaba"},{"source_name":"PlugX"},{"source_name":"Korplug"},{"source_name":"Sogu"},{"source_name":"Thoper"},{"source_name":"TVT"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"New DragonOK","url":"http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/"},{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"},{"source_name":"FireEye Clandestine Fox Part 2","url":"https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html"},{"source_name":"Lastline PlugX Analysis","url":"https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2"}]},"assertions":[{"id":"enterprise:relationship--006104e8-1188-4fcf-b0b0-c7a7131bcdad","subject":"ATTACK:enterprise:G1047","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--006104e8-1188-4fcf-b0b0-c7a7131bcdad","modified":"2026-07-31T18:48:23.698Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0644d7f4-edb2-4fbf-81bb-498d1962ad4e","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1622","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0644d7f4-edb2-4fbf-81bb-498d1962ad4e","modified":"2026-04-29T14:23:05.912Z","references":[{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--067ece2b-4e66-437f-88e0-8dc3f076331b","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--067ece2b-4e66-437f-88e0-8dc3f076331b","modified":"2026-04-29T14:23:05.912Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--07702379-2d40-48ae-a077-d68e0da5e4be","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1083","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07702379-2d40-48ae-a077-d68e0da5e4be","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0bb197ea-3530-4cd5-861a-26ef8bb1f6f9","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1614","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0bb197ea-3530-4cd5-861a-26ef8bb1f6f9","modified":"2026-04-29T14:23:05.919Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d989c2e-0207-4412-b52a-5d9bf9f96d18","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1036.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d989c2e-0207-4412-b52a-5d9bf9f96d18","modified":"2026-04-29T14:23:05.922Z","references":[{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--12c45410-f606-4f0b-86b9-ee0447447b1f","subject":"ATTACK:enterprise:G1034","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--12c45410-f606-4f0b-86b9-ee0447447b1f","modified":"2026-07-31T18:48:26.873Z","references":[{"source_name":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ca27813-cdc2-4d3c-a3db-d18f1de9c697","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1091","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ca27813-cdc2-4d3c-a3db-d18f1de9c697","modified":"2026-04-29T14:23:05.944Z","references":[{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e66dafa-3cf0-4f21-85e0-a9fa9827aaa1","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1480.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e66dafa-3cf0-4f21-85e0-a9fa9827aaa1","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1fac9041-e22d-417b-8951-8ad63f62b6fa","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1016","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1fac9041-e22d-417b-8951-8ad63f62b6fa","modified":"2026-04-29T14:23:05.948Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22af1cbd-a7fd-4d9f-ba15-d640c217603e","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22af1cbd-a7fd-4d9f-ba15-d640c217603e","modified":"2026-07-31T20:48:26.856Z","references":[{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source_name":"apt41_mandiant","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--234205d5-cc99-435c-bbc8-e2c1d3eb0ac5","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1564.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--234205d5-cc99-435c-bbc8-e2c1d3eb0ac5","modified":"2026-04-29T14:23:05.953Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2eaea386-ee0f-42c4-bca1-ce2d22062f98","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1095","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2eaea386-ee0f-42c4-bca1-ce2d22062f98","modified":"2026-09-03T19:46:54.637Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--301ea2aa-e593-4e19-b3d1-7cf7734611ec","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1204.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--301ea2aa-e593-4e19-b3d1-7cf7734611ec","modified":"2026-04-29T14:23:05.976Z","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30437ed1-5cad-4656-9ae8-c4a06122b613","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30437ed1-5cad-4656-9ae8-c4a06122b613","modified":"2026-04-29T14:23:05.976Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3427863f-d4c4-4272-ad60-1479e42ed4af","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3427863f-d4c4-4272-ad60-1479e42ed4af","modified":"2026-07-31T18:47:37.719Z","references":[{"source_name":"FireEye Clandestine Fox Part 2","url":"https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38f209df-bb69-4971-bbd8-db5a54bbf217","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1056.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38f209df-bb69-4971-bbd8-db5a54bbf217","modified":"2026-04-29T14:23:05.998Z","references":[{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d97f57c-2a7c-4626-8b05-9d345047d3ad","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1102.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d97f57c-2a7c-4626-8b05-9d345047d3ad","modified":"2026-09-02T19:42:04.123Z","references":[{"source_name":"Palo Alto PlugX June 2017","url":"https://researchcenter.paloaltonetworks.com/2017/06/unit42-paranoid-plugx/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4032bd86-db32-4270-98a4-670be6992802","subject":"ATTACK:enterprise:G0126","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4032bd86-db32-4270-98a4-670be6992802","modified":"2026-07-31T18:47:56.408Z","references":[{"source_name":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--412b7fbf-bc21-4373-9f2c-5f0a26482536","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--412b7fbf-bc21-4373-9f2c-5f0a26482536","modified":"2026-07-31T18:48:28.717Z","references":[{"source_name":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"},{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44de6f93-f752-41cd-9372-0e0280c51ee9","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1124","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44de6f93-f752-41cd-9372-0e0280c51ee9","modified":"2026-04-29T14:23:06.019Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a5302f7-b953-4d4b-b080-6f3d5d4da00e","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1620","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a5302f7-b953-4d4b-b080-6f3d5d4da00e","modified":"2026-04-29T14:23:06.027Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b8ebd1a-50ba-463a-b536-3ad8cc5013f8","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1057","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b8ebd1a-50ba-463a-b536-3ad8cc5013f8","modified":"2026-04-29T14:23:06.028Z","references":[{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4cb1a0d0-6276-4c2c-b299-c26c982e9e1e","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1012","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4cb1a0d0-6276-4c2c-b299-c26c982e9e1e","modified":"2026-04-29T14:23:06.030Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"Lastline PlugX Analysis","url":"https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d2c6d2c-f2ae-4447-8ba7-53250207ace2","subject":"ATTACK:enterprise:G1021","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d2c6d2c-f2ae-4447-8ba7-53250207ace2","modified":"2026-07-31T18:48:07.777Z","references":[{"source_name":"Dell SecureWorks BRONZE STARLIGHT Profile","url":"https://www.secureworks.com/research/threat-profiles/bronze-starlight"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54c3c155-6347-4dc5-89df-aae2c15d6c7a","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54c3c155-6347-4dc5-89df-aae2c15d6c7a","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Palo Alto PlugX June 2017","url":"https://researchcenter.paloaltonetworks.com/2017/06/unit42-paranoid-plugx/"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"FireEye Clandestine Fox Part 2","url":"https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"},{"source_name":"Stewart 2014","url":"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b271a21-d91f-489b-b6a1-b223a9094df5","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b271a21-d91f-489b-b6a1-b223a9094df5","modified":"2026-07-31T18:47:37.247Z","references":[{"source_name":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5cd5efff-11d4-4ab0-839b-b277b3f1b98b","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1070.009","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5cd5efff-11d4-4ab0-839b-b277b3f1b98b","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e7460f8-9ea9-4aa4-b06e-15861b02d70e","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1135","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e7460f8-9ea9-4aa4-b06e-15861b02d70e","modified":"2026-04-29T14:23:06.054Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5ee26367-1517-4fda-9dbe-8f9e63cc01eb","subject":"ATTACK:enterprise:G0001","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5ee26367-1517-4fda-9dbe-8f9e63cc01eb","modified":"2026-07-31T18:48:12.299Z","references":[{"source_name":"Cisco Group 72","url":"http://blogs.cisco.com/security/talos/threat-spotlight-group-72"},{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--652af94a-7ff3-4d47-89e5-154c7bc34258","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1127.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--652af94a-7ff3-4d47-89e5-154c7bc34258","modified":"2026-04-29T14:23:06.063Z","references":[{"source_name":"Palo Alto PlugX June 2017","url":"https://researchcenter.paloaltonetworks.com/2017/06/unit42-paranoid-plugx/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68487d82-458b-4f45-b1c8-c6e4affaa226","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68487d82-458b-4f45-b1c8-c6e4affaa226","modified":"2026-07-31T18:47:44.022Z","references":[{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source_name":"DOJ APT10 Dec 2018","url":"https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6bf4098c-7667-44df-bdaa-076b9099f851","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1071.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6bf4098c-7667-44df-bdaa-076b9099f851","modified":"2026-09-03T19:47:00.463Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e763ef9-94cb-4244-bea8-86e6d19bfb71","subject":"ATTACK:enterprise:G0062","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e763ef9-94cb-4244-bea8-86e6d19bfb71","modified":"2026-07-31T18:47:58.821Z","references":[{"source_name":"Proofpoint TA459 April 2017","url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71485f5d-f685-403d-a0da-72acbae0f79e","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71485f5d-f685-403d-a0da-72acbae0f79e","modified":"2026-07-31T18:48:14.832Z","references":[{"source_name":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source_name":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--754790a1-86b9-4421-b8e9-84d3dee51097","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1543.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--754790a1-86b9-4421-b8e9-84d3dee51097","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source_name":"Proofpoint ZeroT Feb 2017","url":"https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source_name":"Lastline PlugX Analysis","url":"https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79106ad4-28d3-4f67-a2c3-116d138ec84a","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1059.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79106ad4-28d3-4f67-a2c3-116d138ec84a","modified":"2026-04-29T14:23:06.090Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c8e34ad-89a4-44cf-bd56-d1583803f086","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1105","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c8e34ad-89a4-44cf-bd56-d1583803f086","modified":"2026-09-03T19:47:02.731Z","references":[{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"},{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80e9ec9c-ecb4-48c3-944c-e318fec4a656","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1686","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80e9ec9c-ecb4-48c3-944c-e318fec4a656","modified":"2026-04-29T14:23:06.102Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8282f068-c2d3-4673-b683-7fbd3a59f38e","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1082","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8282f068-c2d3-4673-b683-7fbd3a59f38e","modified":"2026-04-29T14:23:06.104Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83ea392a-3959-4b29-b7b8-517a20ec836d","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83ea392a-3959-4b29-b7b8-517a20ec836d","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86b00142-a259-4237-b1a8-a8183d581b54","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1497.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86b00142-a259-4237-b1a8-a8183d581b54","modified":"2026-04-29T14:23:06.109Z","references":[{"source_name":"Unit42 PlugX June 2017","url":"https://unit42.paloaltonetworks.com/unit42-paranoid-plugx/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b020cdd-4731-4dd5-8407-7f3076ab1d2d","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1049","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b020cdd-4731-4dd5-8407-7f3076ab1d2d","modified":"2026-04-29T14:23:06.115Z","references":[{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e824b6e-a0b7-4a57-9a7e-89b2c390beec","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1036.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e824b6e-a0b7-4a57-9a7e-89b2c390beec","modified":"2026-04-29T14:23:06.119Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e9798ed-5cb1-4997-9701-d6adefc1bdab","subject":"ATTACK:enterprise:C0047","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e9798ed-5cb1-4997-9701-d6adefc1bdab","modified":"2026-07-31T18:47:19.539Z","references":[{"source_name":"Recorded Future RedDelta 2025","url":"https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a29d9514-3284-4ac2-a93a-e17750519534","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1547.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a29d9514-3284-4ac2-a93a-e17750519534","modified":"2026-04-29T14:23:06.146Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"},{"source_name":"Lastline PlugX Analysis","url":"https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--abea6903-7e77-456d-acb6-22f6a7af8087","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1027.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--abea6903-7e77-456d-acb6-22f6a7af8087","modified":"2026-04-29T14:23:06.159Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4947254-3a74-4708-a45c-65eff5bd9a2c","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1071.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4947254-3a74-4708-a45c-65eff5bd9a2c","modified":"2026-09-03T19:46:52.444Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b896fe24-1ada-47ac-9780-10c9b0785e34","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1070.004","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b896fe24-1ada-47ac-9780-10c9b0785e34","modified":"2026-04-29T14:23:06.177Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb39cbf2-a9dc-4c31-9fb9-b6c456c2005c","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1113","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb39cbf2-a9dc-4c31-9fb9-b6c456c2005c","modified":"2026-04-29T14:23:06.181Z","references":[{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb9e291c-4464-41e2-97b7-e19ce9169118","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1053.005","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb9e291c-4464-41e2-97b7-e19ce9169118","modified":"2026-04-29T14:23:06.181Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c420d58d-2a7e-4eef-a12d-d37e4c9fc9b4","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c420d58d-2a7e-4eef-a12d-d37e4c9fc9b4","modified":"2026-09-02T20:07:47.623Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5692c9d-8cac-4105-ae0b-f3b6c60a2253","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5692c9d-8cac-4105-ae0b-f3b6c60a2253","modified":"2026-09-03T19:46:58.090Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--caaf6cc0-1d43-483a-a0c7-938610d98f48","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1027.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--caaf6cc0-1d43-483a-a0c7-938610d98f48","modified":"2026-04-29T14:23:06.202Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb67b57d-2ab3-4971-9b8d-83768df36df0","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1140","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb67b57d-2ab3-4971-9b8d-83768df36df0","modified":"2026-04-29T14:23:06.203Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf75bbf8-f88c-4277-b486-3bab9901c0c2","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1564.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf75bbf8-f88c-4277-b486-3bab9901c0c2","modified":"2026-04-29T14:23:06.209Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d1c69dc2-dce7-4f6e-a725-03aa8356b54d","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1120","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d1c69dc2-dce7-4f6e-a725-03aa8356b54d","modified":"2026-04-29T14:23:06.212Z","references":[{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7fa6787-4b79-44cf-986e-558a5c7b2aac","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1041","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7fa6787-4b79-44cf-986e-558a5c7b2aac","modified":"2026-09-03T19:47:01.641Z","references":[{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--deafd60c-af1a-40eb-bc43-287b37553fae","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1106","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--deafd60c-af1a-40eb-bc43-287b37553fae","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Lastline PlugX Analysis","url":"https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e809f78f-344d-4169-a145-89023f4530d5","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1027","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e809f78f-344d-4169-a145-89023f4530d5","modified":"2026-04-29T14:23:06.241Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee2739de-6829-4c73-b72b-91ba4b9fac5c","subject":"ATTACK:enterprise:G0017","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee2739de-6829-4c73-b72b-91ba4b9fac5c","modified":"2026-07-31T18:48:26.894Z","references":[{"source_name":"New DragonOK","url":"http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6353949-0c13-4254-b7a0-a7ebc7a80f99","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1033","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6353949-0c13-4254-b7a0-a7ebc7a80f99","modified":"2026-04-29T14:23:06.260Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f85073cb-7f45-4145-8923-58450af3451f","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1027.013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f85073cb-7f45-4145-8923-58450af3451f","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9911b03-f413-483b-b228-f5a82657c2d1","subject":"ATTACK:enterprise:G0044","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9911b03-f413-483b-b228-f5a82657c2d1","modified":"2026-07-31T18:48:18.853Z","references":[{"source_name":"Kaspersky Winnti April 2013","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc7c27b4-e18f-486a-b7f8-9eb61eec23f2","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:S0013","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc7c27b4-e18f-486a-b7f8-9eb61eec23f2","modified":"2026-07-31T18:47:53.831Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source_name":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source_name":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source_name":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}