Threat Intelligence Tarot
swords · 5
China (MSS-linked)
G0129★★★★★
risk 3/5
✦ The Nomadic Eye ✦
Mustang Panda
TA416 · RedDelta · Bronze President · HoneyMyte · Stately Taurus
TibetMyanmarVaticanEU political entitiesNGOsSoutheast Asia
Active since ~2012 · Political intelligence, Geopolitical monitoring, Religious group surveillance
Wherever China negotiates, The Nomadic Eye arrives first. When the Vatican opened diplomatic talks, its network was already compromised. When Myanmar shifted governments, the new ministers found it watching. It follows the map of Chinese strategic interest.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Vatican network compromise ahead of China–Holy See negotiations (2020)
- ◆Myanmar government targeting after 2021 coup
- ◆EU mission in Myanmar compromise
- ◆PlugX and TONEINS malware campaigns across Southeast Asia
Defenses
- ▸Macro execution controls and Office hardeningCIS Control 2 ↗
- ▸Diplomatic and NGO sector threat intelligence sharingNIST CSF: ID.RA ↗
- ▸DNS filtering to block known C2 infrastructureCIS Control 9 ↗
- ▸Endpoint protection with PlugX-specific detection signaturesNIST CSF: DE.CM ↗
Reversed: Their Weakness
Mustang Panda's use of PlugX - a well-documented, widely-shared Chinese APT tool - made attribution relatively straightforward. The tool's prevalence across multiple Chinese APT groups created attribution complexity but not deniability.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.