We found archives containing samples of MQsTTang in two GitHub repositories belonging to the user YanNaingOo0072022. We attribute this new backdoor and the campaign to Mustang Panda with high confidence based on the following indicators. Map showing known and suspected targets of MQsTTang Attribution Figure 1 shows our view of the targeting for this campaign.įigure 1. As documented by fellow researchers at Proofpoint, Mustang Panda has been known to target European governmental entities since at least 2020 and has increased its activity in Europe even further, since Russia’s invasion of Ukraine. This would also be in line with the targeting of the group’s other recent campaigns.

However, due to the nature of the decoy filenames used, we believe that political and governmental organizations in Europe and Asia are also being targeted. We also have information indicating that this campaign is targeting a governmental institution in Taiwan. We have seen unknown entities in Bulgaria and Australia in our telemetry. In a departure from the group’s usual tactics, MQsTTang has only a single stage and doesn’t use any obfuscation techniques. Mustang Panda is known for its customized Korplug variants (also dubbed PlugX) and elaborate loading chains. Unlike most of the group’s malware, MQsTTang doesn’t seem to be based on existing families or publicly available projects. This backdoor is part of an ongoing campaign that we can trace back to early January 2023. ESET researchers tease apart MQsTTang, a new backdoor used by Mustang Panda, which communicates via the MQTT protocolĮSET researchers have analyzed MQsTTang, a new custom backdoor that we attribute to the Mustang Panda APT group.

Key eset 14