More details emerge on China's widespread Ukraine

China's decade-old Mustang Panda hacking group is adjusting both its tactics and lures, researchers say.

More details are emerging about the activities of a prolific Chinese government hacking group and how it’s used Russia’s invasion of Ukraine as part of its ongoing efforts to infiltrate a diverse range of target networks across three continents in pursuit of espionage and information theft.

Mustang Panda — otherwise known as Bronze President, HoneyMyte or RedDelta — has been targeting European and Russian entities using topical phishing lures coinciding roughly with the start of the Russian war to deliver malware. Some of the activity has been reported, but researchers with Cisco’s Talos Intelligence Group detailed Thursday previously unreported file samples, website domains and IP addresses associated with the wide-ranging campaigns.

The role of Chinese hacking efforts in connection with Russia’s invasion has been closely watched, but so far there hasn’t been substantial public reporting that the country’s open political alliance with Russia is reflected in its cyber efforts. Instead, Chinese hacking activities have followed traditional patterns of establishing long-term persistence in target networks in furtherance of espionage and information theft objectives.

“Over the years, Mustang Panda has evolved their tactics and implants to target a wide range of entities spanning multiple governments in three continents, including the European Union, the U.S., Asia and pseudo allies such as Russia,” the researchers wrote. “Mustang Panda is a highly motivated APT group relying primarily on the use of topical lures and social engineering to trick victims into infecting themselves.”

In early March cybersecurity researchers with both Google’s Threat Analysis Group and Proofpoint detailed Mustang Panda campaigns targeting European diplomatic entities with topical phishing lures, particularly with respect to refugee and migrant services.

Last week, Secureworks Counter Threat Unit published findings on the group’s use in early March of an English-language decoy document with a Russian title discussing refugee and migrant pressures on Belarus to deliver its well-known PlugX malware variant. That campaign targeted a border guard unit in an eastern Russia town along the Chinese border.

Thursay’s report from Talos discusses the same decoy document, but notes that by the end of March, Mustang Panda updated its tactics to reduce the remote URLs used to host and deploy the various parts of the malware. The researchers found examples of this behavior in two English-titled files related to the war on Ukraine and directed at unnamed targets.

The research also details a previously undisclosed Ukrainian-themed phishing lure with a title designed to make it look like it was an official statement from the National Security and Defense Council of Ukraine. The malware, sent to unnamed targets in late February, sought to establish a reverse shell, which would allow the attackers to deploy further attacks.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure