File · Mofang · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 6 techniques across 3 tactics
Analyst brief
misp-galaxy + mitre-attackMofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.
Observed targets (as stated by the sources)
7 countries · 2 sectorsassessed origin · Chinaobserved targets · 7
countries · 7
- Myanmar
- Germany
- Singapore
- Canada
- India
- United States
- South Korea
sectors · 2
- Government
- Private sector
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique6 techniques · 3 of 15 tactics
Initial access
2 techniquesExecution
2 techniquesStealth
2 techniques
select a technique
Arsenal
1 malware · 1 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
5 sourcesTrack Mofang on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.