Ankura CTIX FLASH Update - March 3, 2023

Malware Activity

New "MQsTTang" Backdoor Identified and Attributed to Mustang Panda

"MQsTTang", a new custom backdoor, has been discovered and attributed to the Chinese advanced persistence threat (APT) group Mustang Panda. Researchers observed this malware in an ongoing social engineering campaign that likely began in January 2023 and appears to be targeting government and political organizations in Europe, Asia, and Australia. Researchers noted that the malware "doesn't seem to be based on existing families or publicly available projects" and does not follow the group's usual tactics. The initial attack vector is believed to be through spearphishing. MQsTTang is being distributed through RAR archives, which contain single executables that are commonly named as phrases related to passports or diplomacy. MQsTTang uses the MQTT protocol for its command-and-control (C2) communication, which is not a technique typically used amongst publicly documented malware