Mustang Panda
Mustang Panda is a China-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 10 sectors, including Government and Manufacturing, in 58 countries, including the United States and the United Kingdom. It uses 175 MITRE ATT&CK techniques and exploits 13 known CVEs.
- Origin
- China
- Techniques
- 175
- Exploited CVEs
- 13
- First seen
- Mar 17, 2021
- Last seen
- Dec 30, 2025
- Record updated
Who They Target.
About Mustang Panda.
From early May 2020, The Vatican and the Catholic Diocese of Hong Kong were among several Catholic Church-related organizations that were targeted by RedDelta, a Chinese-state sponsored threat activity group tracked by Insikt Group. This series of suspected network intrusions also targeted the Hong Kong Study Mission to China and the Pontifical Institute for Foreign Missions (PIME), Italy. These organizations have not been publicly reported as targets of Chinese threat activity groups prior to this campaign. These network intrusions occured ahead of the anticipated September 2020 renewal of the landmark 2018 China-Vatican provisional agreement, a deal which reportedly resulted in the Chinese Communist Party (CCP) gaining more control and oversight over the country’s historically persecuted “underground” Catholic community. In addition to the Holy See itself, another likely target of the campaign includes the current head of the Hong Kong Study Mission to China, whose predecessor was considered to have played a vital role in the 2018 agreement.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.