The China-linked nation-state hacking group referred to as Mustang Panda is using lures related to the ongoing Russo-Ukrainian War to attack entities in Europe and the Asia Pacific.
That’s according to the BlackBerry Research and Intelligence Team, which analysed a RAR archive file titled “Political Guidance for the new EU approach towards Russia.rar.” Some of the targeted countries include Vietnam, India, Pakistan, Kenya, Turkey, Italy, and Brazil.
Mustang Panda is a prolific cyber-espionage group from China that’s also tracked under the names Bronze President, Earth Preta, HoneyMyte, RedDelta, and Red Lich.
It’s believed to be active since at least July 2018, per Secureworks’ threat profile, although indications are that the threat actor has been targeting entities worldwide as early as 2012.
Mustang Panda is known to heavily rely on sending weaponized attachments via phishing emails to achieve initial infection, with the intrusions eventually leading to the deployment of the PlugX remote access trojan.
images from Hacker News