Scworld

Mustang Panda Cyberespionage Targets Global Diplomats with Phishing Campaign

First seen 6 Feb 2026, 07:03 UTC • Scworld

•78% similarity •55.0

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Chinese state-sponsored group Mustang Panda, also known as HoneyMyte, conducted a cyberespionage campaign targeting government officials and diplomats worldwide. This operation involved malicious emails disguised as U.S. diplomatic briefings, containing a harmful PDF that deployed surveillance tools. The campaign took place between late December 2025 and mid-January 2026.

ThreatCluster AI How this analysis works

Attack Flow

10 entities, 17 inferred relationships (STIX 2.1).

Threat Actor (2)

HoneyMyte
Mustang Panda

Technique (4)

Malware
Phishing
T1059.001 - PowerShell
T1566.001 - Spearphishing Attachment

Campaign (1)

Mustang Panda Surveillance Campaign

Malware (1)

PlugX

Tool (2)

Doplugs
PowerShell

Relationships

HoneyMyte uses PlugX
Mustang Panda uses PlugX
HoneyMyte uses Doplugs
HoneyMyte uses PowerShell
Mustang Panda uses Doplugs
Mustang Panda uses PowerShell
HoneyMyte uses Malware
HoneyMyte uses Phishing
HoneyMyte uses T1059.001 - PowerShell
HoneyMyte uses T1566.001 - Spearphishing Attachment
Mustang Panda uses Malware
Mustang Panda uses Phishing
Mustang Panda uses T1059.001 - PowerShell
Mustang Panda uses T1566.001 - Spearphishing Attachment
Mustang Panda Surveillance Campaign attributed to HoneyMyte
Mustang Panda Surveillance Campaign attributed to Mustang Panda
Mustang Panda Surveillance Campaign uses PlugX

Community

Browse all →

Tracked Entities in This Story

HoneyMyte Mustang Panda PlugX Mustang Panda Surveillance Campaign Government

Mustang Panda Cyberespionage Targets Global Diplomats with Phishing Campaign

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story