Podcast: The Puppet Masters: Mustang Panda’s Long Con Against ASEAN Diplomats

Tova Dvorin (00:01.98) It’s June 2025. A senior diplomat for an EU member state is sitting in the business lounge of a major Southeast Asian airport. He’s tired. He’s between flights and he needs to check his briefing notes for a high stakes summit on the South China Sea trade routes. Adrian (00:17.346) He opens his laptop. He sees the airport’s free Wi-Fi portal. He clicks connect. A familiar looking screen pops up. Please sign in with your Microsoft 365 account to continue. Tova Dvorin (00:30.004) To him, it looks like a standard security measure. Maybe the airport has a partnership with Microsoft. He’s in a hurry, so he types in his credentials. The screen flicker says connected, and he goes about his business. Adrian (00:40.514) But he didn’t just connect to the internet. He just handed his entire digital life and his government’s classified communications to a group in Chengdu, China. Tova Dvorin (00:52.328) The free Wi-Fi wasn’t from the airport. It was a captive portal hijack, a digital snare set by a group known as Mustang Panda. And by the time the diplomat lands in Brussels, his inbox has been mirrored, his contacts mapped, and a silent piece of malware is already jumping from his laptop to the embassy secure server. Tova Dvorin (01:11.336) I’m Tova Dvorin and your host and welcome back to the SafeReach studios for the Cyber Resilience Brief, a SafeReach podcast. Adrian (01:18.062) And I’m Adrian Cully, your co-host. Welcome back to the Dragon’s Digital Shadow, our China Deep Dive threat series. And this is episode four, the Puppet Masters. Tova Dvorin (01:28.084) Today, Adrian, we’re talking about the masters of the long con. While other groups are busy trying to blow up power grids or steal billions, Mustang Panda is playing the long game of social and political engineering. Adrian, we’ve talked about typhoons and dragons, but Mustang Panda has a bit of different reputation in the cybersecurity world. They aren’t the quietest group, but they are incredibly persistent. Adrian (01:50.808) Yeah Tova, Mustang Panda, also tracked as APT27 or Bronze President, is like the uninvited guests of the internet. They’ve been around since at least 2012 and they have a very specific type. They target NGOs, non-profits, religious groups and diplomatic entities. Tova Dvorin (02:11.506) More specifically, groups that the Chinese Communist Party politically views as part of the Five Poisons or threats to their domestic stability. We’re talking about Tibetan groups, Uyghur activists, and pro-democracy advocates in Hong Kong. Adrian (02:25.134) Correct, but lately, starting in 2024 and through 2025, they’ve expanded. They’ve gone global in some respects. We’ve seen them hitting government ministries in Africa, Europe and throughout the ASEAN nations. Tova Dvorin (02:41.662) What makes them so dangerous isn’t necessarily a super virus. It’s how they get into your head before they get into your computer. Adrian, we’ve talked off mic. You call this Social Engineering 2.0. Adrian (02:53.002) Exactly, most hackers send a generic invoice attached email. Mustang Panda sends you a document that looks like a confidential report on the exact topic you’re working on. If you’re a diplomat working on the 2026 trade summit, they’ll send you an email titled Draft Agenda for 2026 Summit Confidential. Tova Dvorin (03:11.26) And it’s not just the title, the content inside, even the stuff you can see in the preview, is often stolen from a previous breach of a different diplomat. And that means it looks real, because parts of it are real. This is beyond spearphishing. It’s laserphishing with radar support, highly targeted and bespoke precision social engineering. It’s hearts and minds, super sensei level social engineering. Tova Dvorin (03:36.714) Now go back to that airport scenario, the captive portal attack. This feels like a major evolution for Mustang Panda in 2025. Let’s talk a little bit about why. Adrian (03:46.444) It is Tova, it’s moving the attack from the digital inbox to the physical world. In the last year we’ve seen reports of Mustang Panda teams actually being physically present near major international summits, G20 meetings, ASEAN summits. Security advice for everyone, be very wary and suspicious of guest wifi. Be double wary of airport free guest wifi and be extraordinarily wary of executive lounge guest wifi. Why? Well it’s just as much about psychology as is about being technical. Even long term, highly expensive, deep cover agents have been known to drop their guard and communicate using their real identities in airport executive lounges. Globally, it’s a prime intelligence service and signals interception hunting ground. Exercise extreme caution in these digital environments. Tova Dvorin (04:39.815) Yeah, and these threat actors are into the airport with guns. They’re there with pineapples. Adrian (04:45.742) striking mental image Tova, but that’s not the fruit. We’re talking about a wifi pineapple. It’s a small portable device that can spoof legitimate wifi networks and can work off something as small as a raspberry pie. Tova Dvorin (04:48.041) Thank Tova Dvorin (04:59.377) Wow, you know, and it is sad in a way because airports restrict the entering of real fruit. So if it was real fruit, we might be more protected there. And by the way, here’s another good name for our safe breach cocktail, the wifi pineapple mixer. Look for it in a bar near you. But anyway, our threat actor set up a shadow network that has a stronger signal than the actual airport wifi, which means that your phone or laptop will automatically connect to the strongest signal it recognizes and it will jump up your list first. Adrian (05:28.174) And then comes the captive portal element, that login screen. In 2025, Mustang Panda started using a technique called the credential pass-through. When you type your password into their fake screen, their server instantly tries it on the real Microsoft.Google login page. If it works, they then pass you through to the real internet. Tova Dvorin (05:47.529) So you never even know what happened. You get your wifi, you check your email, everything seems fine. Adrian (05:52.065) Meanwhile, they’ve just installed a token on your machine, a piece of code. This token allows them to bypass multi-factor authentication, which is a big deal. A six digit phone you get from code you get from your phone. It can be bypassed for months. They are authenticated as you. Tova Dvorin (06:10.417) It’s a complete hijacking not only of your phone and your systems, but your trust. And they’ve used this to devastating effect against NGO workers in the Middle East and Southeast Asia in the last few months. By the way, quick note, we are only at six and a half minutes instead of nine. I don’t know if you want to expand a little bit. Adrian (06:26.313) We’ll keep going, we’ll keep going. Tova Dvorin (06:27.953) Okay. Even though they rely on social engineering, Mustang Panda still has some pretty nasty technical tools once they’re inside. Adrian let’s talk about one of those tools, which is PlugX. Adrian (06:39.4) One second, right in middle of recording, Google just made me log out and log in. Tova Dvorin (06:44.84) No worries. Adrian (06:46.584) I’m going challenges with that. Your Sue is getting problems this morning. Adrian (06:57.806) Plug X is a classic. It’s a remote access Trojan. Chinese actors have been using it for over a decade, but Mustang Panda treats it like a Swiss Army knife. They’re constantly modularizing it. Tova Dvorin (07:10.085) Right, and in early 2026, a new variant was discovered of PlugX that uses binary planting to hide inside legitimate Windows processes. Adrian (07:19.968) It’s that living off the land theme again. They’ll hide the plug X code inside the legitimate file, like a calculator app or a printer driver. When the computer starts, it loads the safe file and the malware side loads right along with it. Tova Dvorin (07:34.457) Right, but then here’s the most Mustang Panda thing ever. It’s called the USB worm. Adrian (07:39.595) This is both brilliantly high tech Tova and high impact. So start again. This is both brilliantly low tech Tova and high impact. They’ve developed a variant of plug X that infects USB drives. If you plug a thumb drive into an infected laptop to save a file, the malware hides itself inside a hidden partition on the drive. Tova Dvorin (08:01.235) sneaky sneaky. Then when you take that drive to an air-gapped computer, one that isn’t connected to the internet for security reasons, and plug it in… Adrian (08:08.846) Boom. The malware jumps the gap, it waits until that second computer eventually connects to any network, and then it phones home to Chengdu China. They’ve used this to breach secure military networks in countries that thought they were completely isolated from the internet. Tova Dvorin (08:25.437) You know, we’re seeing a massive spike in Mustang Panda activity right now around the time of this recording, which is in February 2026, specifically targeting the ACN member states. Why now? Adrian (08:36.526) It’s all about the South China Sea. As the PRC rushes and pushes its maritime claims, they need to know exactly what the neighbouring countries, Vietnam, the Philippines, Malaysia, Indonesia, are saying to each other behind closed doors. Tova Dvorin (08:51.855) We’ve seen reports that the personal devices of at least three ACN foreign ministers were compromised in the last 90 days. Adrian (08:59.084) The this time, a fake document regarding the 2026 Code of Conduct for the South China Sea. It was sent from a spoofed email address that looked like it came from the Indonesian Ministry of Foreign Affairs. Tova Dvorin (09:12.489) It’s the ultimate puppet show. By controlling the information that these diplomats see, and by knowing their private negotiating positions, Beijing can steer the diplomacy without ever firing a shot. Adrian (09:22.516) It’s not just hacking, it’s statecraft by another means. Tova Dvorin (09:26.471) And it means you always need to have cybersecurity at the home. Adrian (09:30.574) digital collection. Tova Dvorin (09:35.227) Adrian must take panda is a reminder that you can have the most expensive firewall in the world, the best encryption, and the most secure servers, but if a tired diplomat clicks connect on the wrong Wi-Fi, it’s all for nothing. Adrian (09:46.603) over the vulnerability isn’t the software it’s the human sitting in the chair. What we’ve got is highly skilled social engineers, highly skilled technicians, highly skilled reverse engineers and offensive cyber security engineers actively targeting people who’ve actually had counter intelligence training and cyber security training and still succeeding in compromising them. As you said earlier, it’s beyond spearphishing. is laser guided, radar supported fishing that’s absolutely at super sensi, hearts and minds level. Tova Dvorin (10:22.599) Right. Well, fortunately, sorry, you go. Adrian (10:25.262) So what can you do about this listeners? Tova Dvorin (10:29.843) Fortunately, our excellent research and development lab and their teams have in-depth knowledge of APT-27, also known as Mustang Panda, and their attack code, their TTPs, and their behaviors. These are maintained in a dedicated simulation scenario, which we encourage all of our customers and listeners to use. Adrian (10:46.254) Please don’t fall victim to Mustang Panda. Execute the full kill chain attack scenario yourselves before they get a chance to breach you and plug those gaps. Tova Dvorin (10:56.039) and don’t forget to run it continuously. We’ve seen how they target infrastructure, how they poison the supply chain, and how they manipulate individuals. But as we move into the final stages of our series on Chinese threat actors, the story takes an even darker turn. Adrian (11:09.55) because China isn’t acting alone anymore. Tova Dvorin (11:14.001) Next time on the Dragon’s Digital Shadow, we explore the axis of destruction. We’re looking at the deepening and often terrifying cooperation between the hackers of the Chinese Ministry of Security Services and the Russian GRU. Adrian (11:25.986) Ministry of State Security. Tova Dvorin (11:27.881) We’re looking at the deepening and often terrifying cooperation between the hackers of the Chinese Ministry of State Security and the Russian GRU. Adrian (11:37.282) We’ll look at how they’re sharing tools, sharing targets and preparing for a coordinated digital offensive that the West might not be yet prepared to stop. Tova Dvorin (11:48.083) So stay tuned listeners for more on that in our upcoming episodes. Adrian (11:51.95) Until next time, stay safe, stay safe with SafeBreach. where did that get us to?