#mustangpanda — Public Fediverse posts

Mustang Panda Unveils Modular FDMTP Backdoor in Cyberespionage Push

Cyberespionage groups like Mustang Panda are constantly evolving their tactics, and a recent campaign has seen the emergence of a modular backdoor that allows attackers to adapt and persist in compromised environments. This sophisticated tool enables hackers to blend in with legitimate processes, making it a major concern for security…

https://osintsights.com/mustang-panda-unveils-modular-fdmtp-backdoor-in-cyberespionage-push?utm_source=mastodon&utm_medium=social

#Cyberespionage #ModularBackdoor #Fdmtp #MustangPanda #EarthPreta

quote :
#DreamSecurity 判定這波攻勢是由中國網路間諜組織 #MustangPanda 發動。該組織利用各國的頭條新聞或重要議題作為誘餌，藉此竊取國家機密並潛伏在美國政府機構之中。

#APT

#中國 #駭客 鎖定全球外交官員寄假美國政策檔案　開啟即遭駭入
https://www.cna.com.tw/news/aopl/202602040014.aspx

💔 10M Dating App Users Exposed in Match Group Breach 💔

ShinyHunters cybercrime group claims to have stolen over 10 million records from Match Group (NASDAQ: MTCH), owner of Tinder, Hinge, Match.com, and OkCupid. The alleged breach, posted January 28, 2026, includes user behavioral data from Appsflyer analytics (swipes, matches, sessions, geo-locations), hundreds of internal corporate documents, and highly sensitive personal information including romantic preferences. The 1.76GB compressed dump appears linked to ShinyHunters' broader Okta voice-phishing campaign that has already compromised Crunchbase, Betterment, and SoundCloud.

Sources:
- https://x.com/justabreach/status/2016436843164696661
- https://www.ransomware.live/id/TWF0Y2ggR3JvdXBAc2hpbnlodW50ZXJz
- https://cybernews.com/security/hinge-okcupid-data-leak-shinyhunters-claims/
- https://darknetsearch.com/knowledge/news/en/match-group-leak-2026-urgent-data-breach-impact-guide/
- https://www.binance.com/en/square/post/01-28-2026-data-breach-exposes-millions-of-user-records-from-dating-apps-35696579060105

#Tinder #PlentyofFish #Hinge #OKCupid #Match.com
-----------------

🐴 Chinese APT Upgrades Backdoor with Browser Stealers 🐼

|Chinese espionage group Mustang Panda (aka HoneyMyte) has updated its CoolClient backdoor to steal login credentials from Chrome, Edge, and Chromium-based browsers while monitoring clipboard activity. Kaspersky researchers observed the malware targeting government entities in Myanmar, Mongolia, Malaysia, Russia, and Pakistan throughout 2025. The backdoor was deployed via compromised legitimate software from Sangfor, a Chinese cybersecurity company, and uses hardcoded API tokens for Google Drive and Pixeldrain to exfiltrate stolen data.

Sources:
- https://www.bleepingcomputer.com/news/security/chinese-mustang-panda-hackers-deploy-infostealers-via-coolclient-backdoor/
- https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/

#China #CoolClinet #Chrome #Edge #MustangPanda
-----------------

🚨 DHS Agents Doxxed: ICE List Leaks Thousands of Federal Employee Details 🚨

A whistleblower allegedly leaked data on ~4,500 DHS employees (ICE, Border Patrol) to a site called ICE List, exposing names, emails, phone numbers, and job info. While some data came from scraping LinkedIn, centralizing it creates a dangerous attack surface for harassment and phishing. Meta is now blocking links to the site across all platforms.

Sources:
- https://x.com/justabreach/status/2016059957452341347
- https://www.wired.com/story/meta-is-blocking-links-to-ice-list-on-facebook-instagram-and-threads/
- https://www.wired.com/story/ice-agents-are-doxing-themselves/
- https://www.police1.com/officer-safety/ice-list-doxxing-site-alleges-dhs-whistleblower-leaked-identities-of-4-500-agents
- https://www.scworld.com/brief/suspected-russian-ddos-attack-disrupts-ice-agent-data-leak-site

#ICE #Minneapolis #Immigration #DOXED #BorderPatrol
-----------------

💔 10M Dating App Users Exposed in Match Group Breach 💔

ShinyHunters cybercrime group claims to have stolen over 10 million records from Match Group (NASDAQ: MTCH), owner of Tinder, Hinge, Match.com, and OkCupid. The alleged breach, posted January 28, 2026, includes user behavioral data from Appsflyer analytics (swipes, matches, sessions, geo-locations), hundreds of internal corporate documents, and highly sensitive personal information including romantic preferences. The 1.76GB compressed dump appears linked to ShinyHunters' broader Okta voice-phishing campaign that has already compromised Crunchbase, Betterment, and SoundCloud.

Sources:
- https://x.com/justabreach/status/2016436843164696661
- https://www.ransomware.live/id/TWF0Y2ggR3JvdXBAc2hpbnlodW50ZXJz
- https://cybernews.com/security/hinge-okcupid-data-leak-shinyhunters-claims/
- https://darknetsearch.com/knowledge/news/en/match-group-leak-2026-urgent-data-breach-impact-guide/
- https://www.binance.com/en/square/post/01-28-2026-data-breach-exposes-millions-of-user-records-from-dating-apps-35696579060105

#Tinder #PlentyofFish #Hinge #OKCupid #Match.com
-----------------

🐴 Chinese APT Upgrades Backdoor with Browser Stealers 🐼

|Chinese espionage group Mustang Panda (aka HoneyMyte) has updated its CoolClient backdoor to steal login credentials from Chrome, Edge, and Chromium-based browsers while monitoring clipboard activity. Kaspersky researchers observed the malware targeting government entities in Myanmar, Mongolia, Malaysia, Russia, and Pakistan throughout 2025. The backdoor was deployed via compromised legitimate software from Sangfor, a Chinese cybersecurity company, and uses hardcoded API tokens for Google Drive and Pixeldrain to exfiltrate stolen data.

Sources:
- https://www.bleepingcomputer.com/news/security/chinese-mustang-panda-hackers-deploy-infostealers-via-coolclient-backdoor/
- https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/

#China #CoolClinet #Chrome #Edge #MustangPanda
-----------------

🚨 DHS Agents Doxxed: ICE List Leaks Thousands of Federal Employee Details 🚨

A whistleblower allegedly leaked data on ~4,500 DHS employees (ICE, Border Patrol) to a site called ICE List, exposing names, emails, phone numbers, and job info. While some data came from scraping LinkedIn, centralizing it creates a dangerous attack surface for harassment and phishing. Meta is now blocking links to the site across all platforms.

Sources:
- https://x.com/justabreach/status/2016059957452341347
- https://www.wired.com/story/meta-is-blocking-links-to-ice-list-on-facebook-instagram-and-threads/
- https://www.wired.com/story/ice-agents-are-doxing-themselves/
- https://www.police1.com/officer-safety/ice-list-doxxing-site-alleges-dhs-whistleblower-leaked-identities-of-4-500-agents
- https://www.scworld.com/brief/suspected-russian-ddos-attack-disrupts-ice-agent-data-leak-site

#ICE #Minneapolis #Immigration #DOXED #BorderPatrol
-----------------

💔 10M Dating App Users Exposed in Match Group Breach 💔

ShinyHunters cybercrime group claims to have stolen over 10 million records from Match Group (NASDAQ: MTCH), owner of Tinder, Hinge, Match.com, and OkCupid. The alleged breach, posted January 28, 2026, includes user behavioral data from Appsflyer analytics (swipes, matches, sessions, geo-locations), hundreds of internal corporate documents, and highly sensitive personal information including romantic preferences. The 1.76GB compressed dump appears linked to ShinyHunters' broader Okta voice-phishing campaign that has already compromised Crunchbase, Betterment, and SoundCloud.

Sources:
- https://x.com/justabreach/status/2016436843164696661
- https://www.ransomware.live/id/TWF0Y2ggR3JvdXBAc2hpbnlodW50ZXJz
- https://cybernews.com/security/hinge-okcupid-data-leak-shinyhunters-claims/
- https://darknetsearch.com/knowledge/news/en/match-group-leak-2026-urgent-data-breach-impact-guide/
- https://www.binance.com/en/square/post/01-28-2026-data-breach-exposes-millions-of-user-records-from-dating-apps-35696579060105

#Tinder #PlentyofFish #Hinge #OKCupid #Match.com
-----------------

🐴 Chinese APT Upgrades Backdoor with Browser Stealers 🐼

|Chinese espionage group Mustang Panda (aka HoneyMyte) has updated its CoolClient backdoor to steal login credentials from Chrome, Edge, and Chromium-based browsers while monitoring clipboard activity. Kaspersky researchers observed the malware targeting government entities in Myanmar, Mongolia, Malaysia, Russia, and Pakistan throughout 2025. The backdoor was deployed via compromised legitimate software from Sangfor, a Chinese cybersecurity company, and uses hardcoded API tokens for Google Drive and Pixeldrain to exfiltrate stolen data.

Sources:
- https://www.bleepingcomputer.com/news/security/chinese-mustang-panda-hackers-deploy-infostealers-via-coolclient-backdoor/
- https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/

#China #CoolClinet #Chrome #Edge #MustangPanda
-----------------

🚨 DHS Agents Doxxed: ICE List Leaks Thousands of Federal Employee Details 🚨

A whistleblower allegedly leaked data on ~4,500 DHS employees (ICE, Border Patrol) to a site called ICE List, exposing names, emails, phone numbers, and job info. While some data came from scraping LinkedIn, centralizing it creates a dangerous attack surface for harassment and phishing. Meta is now blocking links to the site across all platforms.

Sources:
- https://x.com/justabreach/status/2016059957452341347
- https://www.wired.com/story/meta-is-blocking-links-to-ice-list-on-facebook-instagram-and-threads/
- https://www.wired.com/story/ice-agents-are-doxing-themselves/
- https://www.police1.com/officer-safety/ice-list-doxxing-site-alleges-dhs-whistleblower-leaked-identities-of-4-500-agents
- https://www.scworld.com/brief/suspected-russian-ddos-attack-disrupts-ice-agent-data-leak-site

#ICE #Minneapolis #Immigration #DOXED #BorderPatrol
-----------------

💔 10M Dating App Users Exposed in Match Group Breach 💔

ShinyHunters cybercrime group claims to have stolen over 10 million records from Match Group (NASDAQ: MTCH), owner of Tinder, Hinge, Match.com, and OkCupid. The alleged breach, posted January 28, 2026, includes user behavioral data from Appsflyer analytics (swipes, matches, sessions, geo-locations), hundreds of internal corporate documents, and highly sensitive personal information including romantic preferences. The 1.76GB compressed dump appears linked to ShinyHunters' broader Okta voice-phishing campaign that has already compromised Crunchbase, Betterment, and SoundCloud.

Sources:
- https://x.com/justabreach/status/2016436843164696661
- https://www.ransomware.live/id/TWF0Y2ggR3JvdXBAc2hpbnlodW50ZXJz
- https://cybernews.com/security/hinge-okcupid-data-leak-shinyhunters-claims/
- https://darknetsearch.com/knowledge/news/en/match-group-leak-2026-urgent-data-breach-impact-guide/
- https://www.binance.com/en/square/post/01-28-2026-data-breach-exposes-millions-of-user-records-from-dating-apps-35696579060105

#Tinder #PlentyofFish #Hinge #OKCupid #Match.com
-----------------

🐴 Chinese APT Upgrades Backdoor with Browser Stealers 🐼

|Chinese espionage group Mustang Panda (aka HoneyMyte) has updated its CoolClient backdoor to steal login credentials from Chrome, Edge, and Chromium-based browsers while monitoring clipboard activity. Kaspersky researchers observed the malware targeting government entities in Myanmar, Mongolia, Malaysia, Russia, and Pakistan throughout 2025. The backdoor was deployed via compromised legitimate software from Sangfor, a Chinese cybersecurity company, and uses hardcoded API tokens for Google Drive and Pixeldrain to exfiltrate stolen data.

Sources:
- https://www.bleepingcomputer.com/news/security/chinese-mustang-panda-hackers-deploy-infostealers-via-coolclient-backdoor/
- https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/

#China #CoolClinet #Chrome #Edge #MustangPanda
-----------------

🚨 DHS Agents Doxxed: ICE List Leaks Thousands of Federal Employee Details 🚨

A whistleblower allegedly leaked data on ~4,500 DHS employees (ICE, Border Patrol) to a site called ICE List, exposing names, emails, phone numbers, and job info. While some data came from scraping LinkedIn, centralizing it creates a dangerous attack surface for harassment and phishing. Meta is now blocking links to the site across all platforms.

Sources:
- https://x.com/justabreach/status/2016059957452341347
- https://www.wired.com/story/meta-is-blocking-links-to-ice-list-on-facebook-instagram-and-threads/
- https://www.wired.com/story/ice-agents-are-doxing-themselves/
- https://www.police1.com/officer-safety/ice-list-doxxing-site-alleges-dhs-whistleblower-leaked-identities-of-4-500-agents
- https://www.scworld.com/brief/suspected-russian-ddos-attack-disrupts-ice-agent-data-leak-site

#ICE #Minneapolis #Immigration #DOXED #BorderPatrol
-----------------

💔 10M Dating App Users Exposed in Match Group Breach 💔

ShinyHunters cybercrime group claims to have stolen over 10 million records from Match Group (NASDAQ: MTCH), owner of Tinder, Hinge, Match.com, and OkCupid. The alleged breach, posted January 28, 2026, includes user behavioral data from Appsflyer analytics (swipes, matches, sessions, geo-locations), hundreds of internal corporate documents, and highly sensitive personal information including romantic preferences. The 1.76GB compressed dump appears linked to ShinyHunters' broader Okta voice-phishing campaign that has already compromised Crunchbase, Betterment, and SoundCloud.

Sources:
- https://x.com/justabreach/status/2016436843164696661
- https://www.ransomware.live/id/TWF0Y2ggR3JvdXBAc2hpbnlodW50ZXJz
- https://cybernews.com/security/hinge-okcupid-data-leak-shinyhunters-claims/
- https://darknetsearch.com/knowledge/news/en/match-group-leak-2026-urgent-data-breach-impact-guide/
- https://www.binance.com/en/square/post/01-28-2026-data-breach-exposes-millions-of-user-records-from-dating-apps-35696579060105

#Tinder #PlentyofFish #Hinge #OKCupid #Match.com
-----------------

🐴 Chinese APT Upgrades Backdoor with Browser Stealers 🐼

|Chinese espionage group Mustang Panda (aka HoneyMyte) has updated its CoolClient backdoor to steal login credentials from Chrome, Edge, and Chromium-based browsers while monitoring clipboard activity. Kaspersky researchers observed the malware targeting government entities in Myanmar, Mongolia, Malaysia, Russia, and Pakistan throughout 2025. The backdoor was deployed via compromised legitimate software from Sangfor, a Chinese cybersecurity company, and uses hardcoded API tokens for Google Drive and Pixeldrain to exfiltrate stolen data.

Sources:
- https://www.bleepingcomputer.com/news/security/chinese-mustang-panda-hackers-deploy-infostealers-via-coolclient-backdoor/
- https://securelist.com/honeymyte-updates-coolclient-uses-browser-stealers-and-scripts/118664/

#China #CoolClinet #Chrome #Edge #MustangPanda
-----------------

🚨 DHS Agents Doxxed: ICE List Leaks Thousands of Federal Employee Details 🚨

A whistleblower allegedly leaked data on ~4,500 DHS employees (ICE, Border Patrol) to a site called ICE List, exposing names, emails, phone numbers, and job info. While some data came from scraping LinkedIn, centralizing it creates a dangerous attack surface for harassment and phishing. Meta is now blocking links to the site across all platforms.

Sources:
- https://x.com/justabreach/status/2016059957452341347
- https://www.wired.com/story/meta-is-blocking-links-to-ice-list-on-facebook-instagram-and-threads/
- https://www.wired.com/story/ice-agents-are-doxing-themselves/
- https://www.police1.com/officer-safety/ice-list-doxxing-site-alleges-dhs-whistleblower-leaked-identities-of-4-500-agents
- https://www.scworld.com/brief/suspected-russian-ddos-attack-disrupts-ice-agent-data-leak-site

#ICE #Minneapolis #Immigration #DOXED #BorderPatrol
-----------------

Chinese APT Phantom Taurus Targeted MS Exchange Servers Over 3 Years https://hackread.com/chinese-apt-phantom-taurus-ms-exchange-servers/ #Cybersecurity #PhantomTaurus #CyberAttacks #IIServerCore #MustangPanda #Afghanistan #CyberAttack #Security #backdoor #Pakistan #Malware #NETSTAR #Winnti #China

🚨 PlugX & Bookworm RATs resurface in Asia’s telecom + ASEAN networks.
🔹 PlugX overlaps w/ Naikon + BackdoorDiplomacy
🔹 Bookworm = Mustang Panda’s long-lived modular RAT
🔹 DLL side-loading, RC4 key reuse, stealthy C2
💬 Do overlaps between APT toolkits weaken attribution?
👉 Follow @technadu for sharp threat intel.

#PlugX #Bookworm #MustangPanda #Naikon #BackdoorDiplomacy #ASEAN #APT #ThreatIntel #CyberSecurity #TechNadu

🚨 PlugX & Bookworm RATs resurface in Asia’s telecom + ASEAN networks.
🔹 PlugX overlaps w/ Naikon + BackdoorDiplomacy
🔹 Bookworm = Mustang Panda’s long-lived modular RAT
🔹 DLL side-loading, RC4 key reuse, stealthy C2
💬 Do overlaps between APT toolkits weaken attribution?
👉 Follow @technadu for sharp threat intel.

#PlugX #Bookworm #MustangPanda #Naikon #BackdoorDiplomacy #ASEAN #APT #ThreatIntel #CyberSecurity #TechNadu

🚨 PlugX & Bookworm RATs resurface in Asia’s telecom + ASEAN networks.
🔹 PlugX overlaps w/ Naikon + BackdoorDiplomacy
🔹 Bookworm = Mustang Panda’s long-lived modular RAT
🔹 DLL side-loading, RC4 key reuse, stealthy C2
💬 Do overlaps between APT toolkits weaken attribution?
👉 Follow @technadu for sharp threat intel.

#PlugX #Bookworm #MustangPanda #Naikon #BackdoorDiplomacy #ASEAN #APT #ThreatIntel #CyberSecurity #TechNadu

☠️ ⛓️‍💥 In a novel attack chain, the threat group #MustangPanda has been combining legitimate components with malicious payloads to reduce likelihood of detection. 😨 Needless to say, it's important for #security teams to know how to spot Mustang Panda’s use of MAVInject in campaigns. 🔍

Follow along in our latest #GraylogLabs article as we emulate an infection chain and analyze the activity it produces in #Graylog. 👁️‍🗨️ We'll walk you through:
⚔️ An attack overview
🗝️ The key elements
😬 Persistence
🦹 Emulating the Adversary
🔍 Detections
💡 Indicators

Read on to also learn threat hunting and detection approaches that you can apply in your own environments! 🙌 👇

https://graylog.org/post/adversary-tradecraft-emulating-mustang-pandas-use-of-mavinject-in-recent-campaigns/ #threathunting #cybersecurity #infosec

FBI Uses Malware’s Own ‘Self-Delete’ Trick to Erase Chinese PlugX From US Computers – Source: www.securityweek.com https://ciso2ciso.com/fbi-uses-malwares-own-self-delete-trick-to-erase-chinese-plugx-from-us-computers-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #JusticeDepartment #Malware&Threats #securityweekcom #MustangPanda #securityweek #Government #China #PlugX #fbi

The #FBI has mass-removed the #PlugX #malware from infected US computers. The infections were attributed to #MustangPanda (aka #TwillTyphoon).

Remember this is just one botnet of #PlugX it's still used in the wild by many other threat actor groups.

For you #DFIR folks, ensure you know how to go #ThreatHunting for DLL-Side Loading to find #PlugX in your network.

https://www.bleepingcomputer.com/news/security/fbi-wipes-chinese-plugx-malware-from-over-4-000-us-computers/
#IncidentResponse

FBI Uses Malware’s Own ‘Self-Delete’ Trick to Erase Chinese PlugX From US Computers https://www.securityweek.com/fbi-uses-malwares-own-self-delete-trick-to-erase-chinese-plugx-from-us-computers/ #JusticeDepartment #Malware&Threats #MustangPanda #Government #China #PlugX #FBI

FBI Uses Malware’s Own ‘Self-Delete’ Trick to Erase Chinese PlugX From US Computers https://www.securityweek.com/fbi-uses-malwares-own-self-delete-trick-to-erase-chinese-plugx-from-us-computers/ #JusticeDepartment #Malware&Threats #MustangPanda #Government #China #PlugX #FBI

Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers
#MustangPanda #PlugX
https://www.justice.gov/opa/pr/justice-department-and-fbi-conduct-international-operation-delete-malware-used-china-backed

@c2links scanning #MustangPanda #PlugX - #Hodur with #NoWhere2Hide

https://c2links.com/2024/07/03/tracking-hodur-c2s-with-nowhere2hide-inspired-by-takahiro-haruyamas-research/

Scan results shared here: https://www.nowhere2hide.info:6332/c2?malware_family=Hodur&private=true

Unit42: Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/ #ThreatProtection #BRONZEPRESIDENT #StatelyTaurus #MustangPanda #threatactors #CL-STA-0044 #CortexXSIAM #Government #EarthPreta #CortexXDR #webshells #backdoor #RedDelta #WildFire #TA416

Unit42: Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government https://unit42.paloaltonetworks.com/analysis-of-three-attack-clusters-in-se-asia/ #BehavioralThreatProtection #ThreatProtection #StatelyTaurus #ChinaChopper #CobaltStrike #MustangPanda #threatactors #AlloyTaurus #CL-STA-0044 #CL-STA-0045 #CL-STA-0046 #CortexXSIAM #DNSsecurity #Government #CortexXDR #Gelsemium #webshells #WildFire #GALLIUM #APTs

Тайвань обвинил Пекин в кибератаках на госорганы #Китай, #Тайвань, #APT, #Blacktech, #Taidoor, #MustangPanda, #APT40 https://www.securitylab.ru/news/511308.php https://twitter.com/SecurityLabnews/status/1296021602585452544/photo/1