Mofang
Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--88489675-d216-4884-a98f-49a89fcc1643
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-01T16:36:58+00:00
- Origin source
- attack_description
- Type
- intrusion-set
- Origin country
- CN
MITRE ATT&CK Techniques (6)
Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive
Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope
An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi
Software & Tools (2)
ShimRat has been used by the suspected China-based adversary [Mofang](https://attack.mitre.org/groups/G0103
ShimRatReporter is a tool used by suspected Chinese adversary [Mofang](https://attack.mitre.org/groups/G010
Explore this actor's full graph with Ninja Signal